Zeshan Nasir zeshannasir.com
INFRASTRUCTURE RELIABILITY · KNOWLEDGE GOVERNANCE · LOCAL AI

I build the reliability layer AI depends on.

Models fail when fed decaying context, unverified documentation, or brittle infrastructure. I engineer the deterministic data pipelines, knowledge governance engines, and sovereign high-availability substrates that make enterprise automation trustworthy.

ROLE Optimizely
EXPERIENCE 14+ Years Enterprise IT
LOCATION Stockholm, Sweden
FOCUS Data Reliability for AI
View Selected Systems Direct Contact Resume (PDF)
01 / THESIS

The Reliability Manifesto

Why input fidelity, governed lifecycles, and operational discipline dictate whether AI succeeds in production.

01 / INPUT INTEGRITY

AI fails at the input layer before it fails on model weights.

The industry fixates on parameter counts and prompt hacks while ignoring the ground truth. An LLM cannot reason past stale wiki pages, unversioned runbooks, or broken API schemas. When input data is verified, hallucinations collapse.

“Clean inputs before clever prompts. Truth in, truth out.”
02 / INFRASTRUCTURE CONTRACT

Documentation is infrastructure.

Undocumented systems cannot be safely automated. Documentation is the deterministic interface both humans and autonomous agents execute against. We must treat documentation with code-level rigor: linting, schema validation, and automated lifecycle TTLs.

03 / ENTROPY CONTROL

Knowledge without governance decays.

Enterprise documentation rots at a predictable rate. Without explicit schema metadata, ownership UUIDs, and automated deprecation pipelines, corporate wikis become toxic swamps that poison enterprise RAG and search indexes.

04 / SOVEREIGN MASTERY

Sovereign operation enforces uncheatable rigor.

Cloud APIs abstract away operational truth. Running bare-metal hypervisors, pinning CPU cores, locking resident memory (mlock), tuning KV caches, and validating bare-metal restore drills gives an unshakeable understanding of what reliable systems actually require under pressure.

“If you haven't validated a cold restore drill, you don't have backups—you have wishes.”
02 / SELECTED SYSTEMS

Flagship Architectures

Measured systems engineered for enterprise knowledge governance, sovereign autonomous agents, and high-availability hypervisors.

SYSTEM 01 Enterprise Automation · Knowledge Governance · AI Grounding

Enterprise Knowledge Lifecycle Governance

Knowledge Workspace API Workflow Automation Service Management API Enterprise Search Python

Automated governance engine enforcing documentation contracts, ownership schemas, SLA review cadences, and stale page quarantine to ground enterprise AI in verified truth.

The Problem

As enterprise AI assistants were rolled out, a large share of indexed documentation had no identifiable owner and no review date. Unowned pages produce conflicting operational directives, and an assistant grounded on them repeats the conflict with more confidence than the wiki ever did.

What I Designed & Enforced

Architected an automated validation pipeline connecting enterprise workflow engines with knowledge workspace APIs: enforced mandatory frontmatter schemas (Owner UUID, Cadence TTL, Domain classification). Built automated cron sweeps generating SLA-tracked review tickets in service-management systems. Stale or unresponsive pages are automatically quarantined to an unindexed archive space tagged NOINDEX.

Why It Matters

Transformed a decaying wiki into a living, verified knowledge contract. Search engines and RAG retrieval pipelines now query a clean corpus, eliminating AI hallucinations at the source.

What the design enforces

Every page in a governed space carries an owner and a review cadence, or it does not stay in the index.

How deprecation works

Obsolete pages move to an unindexed archive rather than being deleted, so inbound links resolve instead of breaking.

Employer-internal figures are deliberately omitted. The design is mine to describe; organizational metrics belong to the employer.

Knowledge lifecycle pipeline: pages are validated against an ownership and review-cadence schema, reviews are raised as tracked tickets, and pages that fail review move to an unindexed archive rather than being deleted.
SYSTEM 02 Sovereign AI · Autonomous Operations · Zero-Trust

Hermes: Dossier-Grounded Sovereign Ops Agent

llama.cpp Qdrant Vector DB Tailscale Zero-Trust Prometheus / Loki Proxmox VE

A private, sovereign autonomous operations runtime governed by deterministic dossiers, read-mostly anomaly triage, and mandatory human approval gates.

The Problem

Unconstrained autonomous agents granted direct shell access hallucinate during cascade outages and execute destructive mutations. Conversely, read-only bots cannot assist during complex troubleshooting workflows.

What I Built & Hardened

Engineered a 6-step operational safety loop (Clarify → Inspect → Draft → Preview → Approve → Log). Hermes grounds its reasoning on authoritative cluster dossiers loaded from Qdrant vector memory. State-changing actions (firewall rules, container reboots) are locked behind webhook/terminal approval gates.

Why It Matters

Demonstrates how sovereign local AI can safely operate physical infrastructure without cloud vendor data leaks, vendor lock-in, or runaway mutation risks.

The safety property

No state-changing command executes without a human approving a rendered diff first. The gate is structural, not a policy the agent is asked to follow.

What it actually does

Reads metrics and logs across the cluster, correlates an anomaly to a probable cause, and drafts the remediation for review.

SYSTEM 03 Hypervisors · High Availability · Hardware Isolation

OMEGA Cluster: Sovereign Multi-Node Platform

Proxmox VE 8.x Corosync QDevice Caddy HTTP/3 WireGuard / Tailscale OPNsense PBS

A 2-node hypervisor cluster with an external cloud quorum witness, isolated local LLM inference, and automated bare-metal disaster recovery drills.

The Problem

Small homelab hypervisors suffer from two fatal failure modes: 2-node split-brain during rolling kernel upgrades, and resource starvation when heavy vector search contends with media processing.

What I Engineered

Deployed an external Corosync QDevice witness on an off-site VPS over encrypted mesh, establishing true 3-vote quorum resilience. Decoupled the vector database into a dedicated memory tier and pinned dedicated P-cores with mlock to guarantee stable 128K context inference.

Why It Matters

Allows rolling hypervisor maintenance without guest outages, and ensures local AI workloads run with rock-solid latency guarantees.

Quorum topology
2 + 1 nodes plus witness

An external Corosync QDevice outside the local failure domain breaks the tie, so either node can reboot without freezing cluster state.

Inference tier

Dedicated cores and locked resident memory, so a long-context request is not competing with media work for pages.

03 / THE PLATFORM

What the cluster is, and what it runs

A self-hosted platform I operate personally. The figures below are design parameters, not a live readout — this is a static page and nothing on it is measured in real time.

Hypervisor
2 + 1

Two Proxmox VE nodes with an external quorum witness off-site

Inference
Local

Long-context CPU inference on a dedicated node, resident memory locked

Retrieval
Isolated

Vector memory on its own tier rather than shared with media work

Recovery
Drilled

Deduplicated backups plus scheduled bare-metal restore rehearsals

Platform topology, by role

Private network · OPNsense · WireGuard mesh
Platform topology by role: two hypervisor nodes carrying the inference, vector memory, automation, observability and agent-runtime roles, with an external quorum witness off-site and a private encrypted mesh between them.
Platform roles and the boundary each one is held to. Addresses, host names and ports are deliberately not published.
Role What runs there Operational boundary
Inference Long-context local LLM serving Resident memory locked, performance cores pinned
Vector memory Vector database and embedding API Its own tier, authenticated, never shared with media work
Automation Workflow engine, document pipeline, private search Scheduled and webhook-driven, no inbound public route
Observability Metrics, dashboards, secret storage Ingest only, secrets encrypted at rest
Agent runtime The operations agent described above Read-mostly, every mutation gated on human approval
Edge and services Reverse proxy and self-hosted utilities Reachable only over the private mesh, no forwarded router ports
04 / DECISION RECORDS

Architectural Tradeoffs

Measured engineering decisions made on production systems. Tradeoffs over dogmas.

ADR 01 · CLUSTER RESILIENCE

External Corosync Quorum Witness

Context & Tradeoff

A 2-node physical cluster suffers from split-brain whenever a node reboots for a kernel upgrade, freezing cluster state.

Decision

Deployed a lightweight Corosync QDevice daemon on an offsite VPS over encrypted WireGuard tunnel, outside the local failure domain.

Result

Either physical node can undergo zero-downtime maintenance while retaining quorate state and guest availability.

ADR 02 · STORAGE & MEMORY

Decoupling Vector Tier from Media Planes

Context & Tradeoff

Co-locating vector search workloads with transcoders caused severe memory spikes and I/O latency on shared ZFS pools.

Decision

Moved vector memory onto its own container with its own memory limit and storage allocation, separate from the media plane.

Result

Vector queries stopped contending with transcode I/O, and retrieval latency became predictable rather than spiky under load.

ADR 03 · AUTONOMOUS SAFETY

Read-Mostly Triage with Gated Mutations

Context & Tradeoff

Unconstrained LLM operators risk executing destructive commands during cascade failures; read-only bots lack utility.

Decision

Hermes runtime granted autonomous read access to Prometheus and logs; all state-changing mutations require human cryptographic sign-off.

Result

Rapid automated incident correlation with zero accidental infrastructure drift or unintended destruction.

ADR 04 · DISASTER RECOVERY

Recovery as a Continuous Engineering Contract

Context & Tradeoff

Untested backups provide a false sense of security and fail silently when physical drives fail.

Decision

Automated daily deduplicated snapshots to Proxmox Backup Server paired with scheduled bare-metal restoration drills.

Result

Recovery runbooks are verified against live bare metal with known, predictable RTO/RPO targets.

05 / EXPERIENCE

Experience

Fourteen years of endpoint fleet management, identity governance and high-availability operations, across three countries.

System Administrator at Optimizely in Stockholm: macOS and Windows fleet management, automated knowledge lifecycle governance, and cloud identity hardening for distributed European teams.

14+
Years in enterprise IT
2012
First NOC role
Stockholm
Based in Sweden
EU permit
Right to work
Core Competencies

Microsoft Intune · Jamf Pro · Entra ID (Azure AD) · Conditional Access & MFA · Enterprise Workflow Automation · Proxmox VE · Tailscale Mesh · Caddy HTTP/3 · Linux System Administration · Local LLM Inference Engineering

2022 — PRESENT

System Administrator

Optimizely · Stockholm, Sweden

Device fleet engineering across macOS and Windows (Intune, Jamf Pro) and identity governance (Entra ID, Microsoft 365). Designed the automated documentation governance described above, so enterprise search and assistants retrieve pages that have an owner and a review date.

2020 — 2021

Network & System Administrator

Levi Strauss & Co. (SV Engineering) · Lahore

Supported distributed retail store networking, POS systems, and endpoint security across nationwide retail locations with strict SLA response.

2012 — 2020

IT Systems & NOC Support Engineer

MicroTech Industries · Lahore

Monitored high-availability server clusters via 24/7 PRTG NOC. Administered Active Directory, VMware hypervisors, and disaster recovery replication for 300+ users.

ACADEMIC FOUNDATION

Information Technology & Systems

Virtual University of Pakistan & Uppsala University

BS in Information Technology · Completed 45/60 ECTS in Master's Programme in Information Systems at Uppsala University, Sweden.

06 / OPERATOR

Direct Connection

Open to technical conversations about infrastructure reliability, knowledge governance, and running AI workloads on hardware you control.

LinkedIn

linkedin.com/in/zeshan-nasir Open profile ↗

GitHub

github.com/ZeshanNasir View repositories ↗

Curriculum Vitae

resume.pdf (Latest Build) Download document ↗