Skip to content

Fahmi Harun

Software & AI Systems Builder · Computer Engineering Student @ PCR

I ship production systems end to end — school ops with signed QR attendance, privacy-first web apps, and AI agents that turn messy evidence into verified handoffs.

Pekanbaru, Riau, Indonesia

Portrait of Fahmi Harun
Scroll

Systems I ship

I ship production systems end to end — school ops with signed QR attendance, privacy-first web apps, and AI agents that turn messy evidence into verified handoffs.

I am a Computer Engineering student in the D4 Teknologi Rekayasa Komputer program at Politeknik Caltex Riau, based in Pekanbaru.

I design, build, and operate school-ops software used in a school setting — attendance with HMAC-signed QR flows, and digital assessment platforms with FastAPI, Go, and Flutter clients. The focus is engineering: integrity controls, audit trails, and systems that stay maintainable in production.

Alongside that, I ship privacy-first web apps and AI agent systems — Planner–Executor–Critic orchestration, evidence-to-handoff workflows, and OpenCode overlays with routed skills and MCP. Current exploration stays in full-stack engineering, application security, agent orchestration, and reliable deploy.

Current focus

  1. Computer Engineering student

    Politeknik Caltex Riau · D4 Teknologi Rekayasa Komputer

    Studying computer engineering while building and operating the systems described on this site.

  2. Software & AI systems builder

    SIAB2 · SIAB1 · LensaDiri

    Building and operating school-ops attendance and assessment software, plus privacy-first web systems with security and audit boundaries.

  3. Agent / hackathon builder

    Tanggap60 · Aegis-IDX · OpenCodeHighEnd

    Shipping AI agents and tooling — fraud-evidence handoff workflows, Planner–Executor–Critic IDX investigation, and an OpenCode 2 overlay with routed skills and MCP.

Featured systems

Pinned production systems, privacy-first apps, and recent AI agent builds. Architecture notes come from the public repositories.

Production

SIAB2

Academic and attendance system with a signed Android QR flow, audit logs, and a reconciliation worker.

  • Worker reconciliation for status validation and attendance data sync.
  • Android QR reader integration with HMAC-signed request validation, nonce, and signature checks.
  • Structured production audit procedures and data reconciliation runbooks.

NestJS · React · Vite · TypeScript · Prisma · PostgreSQL · Redis · Nginx · Docker Compose

Production

SIAB1

Digital assessment platform with FastAPI control plane, Go student hot-path, and Flutter / Android kiosk clients — integrity journal, monitoring, and audit logging.

  • Go writer for student hot-path routes; FastAPI for control plane and Nginx fallback.
  • Android kiosk primary client with Flutter fallback; session integrity and autosave.
  • Live monitoring, audit logging, and assessment workflow controls for staff.

FastAPI · Go · Flutter · Android · PostgreSQL · Redis · Celery · Docker

Independent Project

LensaDiri

Privacy-first self-exploration web application with row-level security, consent, and audit boundaries.

  • PostgreSQL Row-Level Security and server-only data fetching boundaries.
  • CSRF protection and opaque HMAC session hashes.
  • Granular consent controls, with Vitest and Playwright coverage.

Next.js · React · TypeScript · PostgreSQL · Supabase tooling · Zod · Argon2id · Vitest · Playwright

Agent tooling

OpenCodeHighEnd

OpenCode 2 overlay with 62 routed skills, a thin AGENTS.md router, MCP pins, Design Bank, and evidence-blocked done-gates.

  • 62 frozen skills: model-invoked specialists plus manual slash commands.
  • Core MCP (Codebase Memory, Context7, shadcn) and Design Bank local search.
  • Installer/runtime overlay with doctor, verify, and Claude Code isolation.

OpenCode 2 · MCP · AGENTS.md · Bash · Linux x86_64

AI Build

Tanggap60

AI HackFest golden-hour fraud-evidence agent — turns messy digital evidence into verified facts, next actions, and human-approved handoff packs.

  • Evidence → verified facts → reporting units → gaps → next best action → approval → handoff pack.
  • Hermes adapter with FastAPI, Jinja, SQLite WAL, OCR, and ReportLab artifacts.
  • Native co-pilot path: voice/text to page actions with GREEN/YELLOW/RED approval gates.

FastAPI · Hermes · SQLite · Pillow · Tesseract · ReportLab · Jinja

AI Build

Aegis-IDX

Sectors Hackathon Planner–Executor–Critic agent for IDX broker-flow investigation — read-only narrative with tool allowlist, audit, and anti-advice guardrails.

  • Planner designs credit-aware steps; Executor runs allowlisted tools; Critic strips speculative advice.
  • Next.js front end with FastAPI backend against Sectors IDX APIs (mock, cache, or live).
  • TRK security model: ticker sanitization, audit.jsonl, credit governor, and soft-fail fallback.

FastAPI · Next.js · TypeScript · Python · Sectors API · Tailwind

  • Ujian Online

    Previous generation

    Earlier examination platform with exam management, monitoring, and asynchronous grading. Superseded in active development by SIAB1.

  • StreamHive

    Independent Project

    Local-first LAN media server with seekable streaming, subtitle support, and QR device pairing.

  • F-INVOICE

    Independent Project

    Invite-only invoice manager with integer IDR money, staff and customer portals, and HMAC-signed PDF links.

How I work

Full-stack engineering, application security (HMAC / QR / audit), agent orchestration, and reliable deploy.

Full-stack web engineering

Web and mobile-backed applications from structured backend services to React, Next.js, and Flutter clients.

Go · NestJS · FastAPI · Next.js · Astro · React · TypeScript · Flutter · Python

Application security & school ops

Signed device flows, audit trails, and production attendance / assessment systems used in schools.

HMAC / QR · Argon2id · RLS · Audit logging · Docker · Nginx · PostgreSQL

Agent orchestration & reliable deploy

Multi-role AI agents, tool allowlists, evidence-gated workflows, and VPS / compose deploy discipline.

Planner–Executor–Critic · MCP · OpenCode overlays · FastAPI agents · systemd / Nginx · Evidence gates

How I decide

Architecture over unverified claims

Every feature is described from concrete architecture, security controls, and code that can be opened.

Accessibility and privacy baseline

Software is built with readable interfaces and explicit data-access boundaries.

Honest engineering

Work is presented from repositories, not from invented metrics or testimonials.

Connect and collaborate

Open for conversations on school-ops software, AI agents, and full-stack collaboration.