AI Engineer
Xsolla · Montréal, remote
AI engineering internship. The work belongs to Xsolla, so it stays off this site and off my GitHub, the same rule that keeps Cadence private.
HIRED
I'm Gautam, Computer Engineering @ uOttawa. I build software around the assumption that networks drop, APIs die, and hardware misbehaves. Don't take my word for it: flip the UPLINK switch in the corner and watch this page handle its own outage. Try it
One town, one storm. The worksite at the west end runs AEGIS; the street at the east end runs Porchlight. Flip the UPLINK switch above and the same outage hits both at once. Switch cameras to fly across town, or drag to orbit. Drawn in 3D with a hand-written projection and no library, so this page still makes zero third-party requests.
CAM-01 runs the real AEGIS pipeline logic: detection → zone rules → state machine → alarm → async uplink. A worker without a hard hat who walks into the hazard zone trips the relay first and the voice after, exactly like the SCHED_FIFO ordering on the device. Cut the uplink and events stack up on the edge device, then flush in chunks of three when it returns. The safety loop never notices. Full design decisions in the engineering log. And the switch is not just a toy: turn your wifi off and reload this page. It still loads, and the switch flips itself.
CAM-02 is a sketch of Porchlight's delivery rules: a beacon press is resent until a neighbour's node acknowledges it, nodes gossip every call to each other and repair gaps on the next exchange, and 30% of all messages are dropped on purpose. Cut the uplink and calls wait on the street, then reach City Hall exactly once when it returns. The project's own test runs 30 nodes, cuts the City link 50 times, and delivers 200 of 200 calls. Like this one, it is a simulation, not a field trial. Built by a team of four at Hack the Hill III, second place in Civic Technology. Read the source.
Confidence-scored SOC incident triage, dual-store: MongoDB for live reads, Snowflake for analytics, so analytics never contend with real-time state. 7-test E2E suite, shipped in 24 hours.
Open a PR, get a full stack; close it and it's gone. A webhook writes desired state only, and a crash-safe reconciler advances one step per tick against idempotent providers.
Five agents turn plain English into deployed infrastructure. Approval gates, rollback, immutable audit log. Nothing reaches prod without a human.
An emergency network neighbours run themselves. A signed beacon press hops laptop to laptop with no power, internet or cell service, and reaches the City when any link returns. 200 of 200 calls delivered in chaos simulation; not yet field tested.
Every scraper heals itself with AI now; nobody checks the repair was correct. Bedrock verifies each heal against golden fixtures before it ships, and every row carries a receipt naming the heals it refused.
Access governance for people and AI agents. Every grant into one approval queue, protected resources never bulk-approved, and a hash-chained ledger that stopped forking under concurrent writes once review caught it.
The EU Cyber Resilience Act gives a manufacturer 24 hours from becoming aware that a vulnerability in its product is actively exploited to send an early warning. This GitHub Action builds a CycloneDX SBOM from 12 lockfile formats, checks OSV, CISA KEV and EPSS, and opens an issue with the deadlines and draft reports. If the KEV catalog can't be read, it says so instead of reporting clean.
Find the pill that's treating another pill. Three AI agents walk one FalkorDB medication graph to find prescribing cascades in older adults. Every action waits for a human, and the output is a question for the pharmacist, never "stop this drug". Replayed over 600 synthetic patients generated from the same knowledge graph, it would have stopped 401 of the 534 cascade drugs it met at the first extra prescription; that tests the reasoning, not clinical validity. Built solo, with AI assistance, for Graph Hacks 2026. Synthetic patients only; decision support for clinicians, not medical advice.
Offline buffering, graceful degradation and chaos harnesses go in the initial plan, not the retro. The cloud can make it smarter; correctness lives on the device, where the network can't take it away.
PROVEN · GK-002 §05: the chaos harness that caught the lossy flushMy own tests agree with me by construction. The number that counts comes from a judge I don't control: the government's own calculator, a brute force search, a back-of-envelope physics model. When the judge disagrees, the disagreement is published.
PROVEN · GK-012: 8,838 of 9,002 against the CRA's calculator, all 164 misses publishedApproval gates, audit trails, rollback. Every autonomous system I ship can be stopped, questioned, and reversed.
PROVEN · HyperShift: nothing deploys past the approval gateMock generators, load testers, fault injection, so the stack ships while the Pi is still in the mail.
PROVEN · GK-002 §05: the upper stack shipped before the Pi arrivedA study that only reports its wins is not evidence. I pre-register the threshold, then report the number I actually got.
PROVEN · GK-005: needed 20%, got 9.8%, published in fullA measurement without its conditions is a rumour. If the harness distorts the number, that warning goes above the number, not in a footnote.
PROVEN · GK-003: WSL2-relative timings, flagged before the tableClearing your own pre-registered bar by five times is an alarm, not a triumph. The broken write-up stays published, marked do-not-cite, and the correction goes next to the claim with a date, because deleting it makes the repo look better and the record worse.
PROVEN · GK-006: the 100% that turned out to be a dead hostnameName the number that counts as a pass while nothing is invested in the answer, and timestamp it somewhere I can't edit. Then say exactly what the timestamp proves. Plumbline's two bars were never evaluated, and its page says so.
PROVEN · GK-014: bar fixed before the first scored call, and the timing claim correctedA gate with an override is decorative. If a sealed rule can be amended by a flag, a config or a paid tier, the artifact is worth nothing to the person it was meant to convince.
PROVEN · GK-010: a test that fails if a code path to mutate a sealed field ever appearsA rule you argue your way past was never a rule. Three not-evaluable readings, and that line of work stopped exactly where its pre-registered rule said it would. The repo, the paper and the data stay public.
PROVEN · GK-009: both pre-registered tests resolved against it, so it stoppedFinding prior art that beats you on the job it does is uncomfortable and burying it is cheap. A security tool that hides the alternative has already told you what kind of tool it is.
PROVEN · GK-011 §06: the README recommends mcp-warden over my own projectA number whose environment was not recorded cannot be re-derived, only re-argued. I have written that caveat on other people's results and then failed to apply it to my own crawl.
PROVEN · GK-011 §08: the recrawl that disproved my own explanationAI engineering internship. The work belongs to Xsolla, so it stays off this site and off my GitHub, the same rule that keeps Cadence private.
Built Cadence, a production inventory and rental system, solo, from requirements gathering with non-technical staff to deployed software. Audited and repaired data-integrity failures and automated recurring workflows.
Explained regulated financial products to high-volume customers under strict compliance: daily practice at making complicated things understandable to people who didn't ask for the details.
Data structures & algorithms, databases, software engineering, computer architecture, discrete math, probability & statistics.
Open to co-op placements and internships in systems, infrastructure, and platform engineering. If you're building something that has to survive failure, I want to hear about it. (Email works even during the outage; it's store-and-forward. That's the point.)