DEV Community: Megh Deb

GitLatch : Your Repository Guard

Megh Deb — Sat, 24 Oct 2026 05:59:40 +0000

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 3: Slow and Steady

What I Built

GitLatch is an enterprise-grade, client-side Static Application Security Testing (SAST) platform and repository governance engine designed to conduct exhaustive, automated audits of continuous integration pipelines and software supply chains entirely on the user's local machine. Powered by Google DeepMind's Gemma 4 E2B large language model executing natively inside the web browser through Google LiteRT-LM (@litert-lm/core) over WebGPU, GitLatch scrutinizes repository configurations, GitHub Actions workflows, composite actions, and multi-ecosystem manifest files without transmitting a single byte of proprietary source code, operational workflows, or confidential environment secrets to external cloud infrastructure.

Problem Statement

Modern software engineering teams rely extensively on automated Continuous Integration and Continuous Delivery (CI/CD) pipelines to compile code, execute test suites, publish release artifacts, and provision production infrastructure. However, automated build workflows have rapidly evolved into the primary and most vulnerable attack vector for modern software supply-chain compromises. GitHub Actions workflows routinely execute untrusted third-party shell scripts using unverified remote piping mechanisms such as curl | bash pipelines devoid of cryptographic signature checks, checksum validations, or execution sandboxing. Furthermore, development teams frequently reference external marketplace actions pinned exclusively to mutable version tags (such as @v1 or @v4) rather than immutable, full-length 40-character commit SHAs, exposing automated runners to silent upstream tag overwrites, compromised maintainer accounts, and automated credential exfiltration.

These uninspected external scripts and custom actions execute with excessive, broad runner privileges that possess direct, unmonitored access to sensitive repository secrets, deploy keys, cloud production credentials, and write-enabled GITHUB_TOKEN authorizations. Traditional static application security testing tools focus almost exclusively on high-level application source code while treating CI/CD automation files as invisible configuration scripts. Consequently, security engineers and maintainers face a dangerous lack of visibility, operating without an automated, preemptive inspection layer capable of detecting malicious script injections, excessive permissions, untrusted event triggers such as pull_request_target, and covert dependency confusion vectors before they compromise production build pipelines.

Solution Approach

GitLatch addresses this critical vulnerability by delivering a multi-stage security audit engine that enforces infrastructure-as-code and workflow governance with the identical rigor applied to production application code. Rather than performing superficial regular expression matches on isolated workflow definitions, GitLatch recursively crawls the entire repository tree to catalog and analyze every asset residing within the complete .github/ directory. This comprehensive crawl encompasses continuous integration workflows, composite actions, Dependabot configurations, bespoke maintenance shell scripts, and administrative governance policies including CODEOWNERS and SECURITY.md.

Simultaneously, GitLatch discovers and parses software supply-chain manifests spanning diverse programming languages and package ecosystems, including Node.js (package.json and lockfiles), Python (requirements.txt, pyproject.toml, Pipfile, and setup.py), Go (go.mod), and Rust (Cargo.toml). The engine processes these artifacts through a synchronized audit pipeline that fuses deterministic static heuristics with contextual neural evaluation. Deterministic parsers identify overt vulnerabilities including wildcard version constraints, dangerous pre/postinstall lifecycle hooks, unscoped internal packages, self-hosted runner risks, and remote piping scripts, while the on-device Gemma neural engine interprets complex execution topologies, shell interpolations, and contextual injection surfaces to deliver granular vulnerability summaries and actionable remediation diffs.

Why We Are Unique

GitLatch establishes an uncompromising, zero-trust client-side privacy model that guarantees complete computational sovereignty on the developer's workstation. While existing enterprise security suites mandate organization-wide read/write permissions, code repository mirroring, and bulk transmission of sensitive workflows to proprietary third-party artificial intelligence cloud platforms, GitLatch performs one hundred percent of its reasoning on-device using local WebGPU acceleration. Proprietary business logic, internal infrastructure addresses, automated deployment routines, and inadvertent secret leaks never cross the boundary of the local browser sandbox.

Beyond client-side privacy, GitLatch delivers publication-grade audit transparency through a native generation engine that compiles formal security reports into a standardized A4 portrait PDF adhering to strict 1.0-inch (25.4mm) margins on all four borders. Designed around high-density monospace Courier typography and explicit, bordered tabular matrices, the exported audit report documents discovered vulnerabilities, runner contexts, affected file paths, and exact remediation advice without token overflow or column clipping. This equips engineering teams, compliance officers, and open-source maintainers with an immutable, audit-ready artifact suitable for compliance verification, SOC2 documentation, and third-party penetration disclosures.

Tech Stack

Core Application Framework: Next.js 15 (App Router), React 19, TypeScript 5
Styling & Visual Interface: Tailwind CSS v4, Lucide React, React Icons (FaGithub), next-themes
Database & Data Persistence: MongoDB, Mongoose (with connection caching and connection pooling)
Authentication & Session Guard: NextAuth v5 (GitHub OAuth Provider), Next.js Edge Middleware
On-Device Neural Security Engine: Google DeepMind Gemma 4 E2B (.litertlm artifact ~1.87 GB)
Client Inference Runtime: Google LiteRT-LM (@litert-lm/core) via WebGPU Compute Shaders
Model Storage & Persistence: File System Access API (showDirectoryPicker), Origin Private File System (OPFS), IndexedDB
Formal Audit Report Generator: jsPDF (monospace bordered grid engine), @react-pdf/renderer
Code Quality & Linter Engine: Biome 2.2.0 (strict code formatting and automated linter verification)

Technical Feasibility and Impact of Gemma

The computational foundation of GitLatch is Google DeepMind's Gemma 4 E2B model, a specialized two-billion parameter neural network designed for high-density edge reasoning and instruction-tuned code analysis. By compiling the Gemma 4 architecture into the highly optimized .litertlm binary format, GitLatch achieves workstation-class static analysis capabilities directly inside consumer web browsers without requiring dedicated cloud server clusters or specialized AI hardware. The model harnesses modern client graphics processors via WebGPU compute shaders, delivering low-latency, real-time inference that operates reliably within client memory boundaries.

The true operational impact of this architecture lies in its offline-first, low-bandwidth paradigm. Following a single initial download of the compressed 1.87 GB model artifact, GitLatch utilizes the modern browser File System Access API with Origin Private File System (OPFS) fallback to persist model weights permanently on the user's local disk. This eliminates ongoing bandwidth consumption, enabling security teams to audit proprietary repositories aboard aircraft, inside air-gapped security enclaves, or across low-connectivity development environments. Furthermore, client-side inference ensures absolute operational consistency, completely immunizing the security scanner against cloud configuration drift, provider API rate limiting, unexpected backend model deprecations, and fluctuating subscription charges.

On-Device Inference Engine and Live Streaming Protocol

The runtime execution architecture of GitLatch couples high-throughput edge model distribution with an on-device WebGPU live streaming inference protocol, orchestrating deep repository audits with continuous, real-time telemetry across both network transport and hardware compute layers.

Akamai Pipeline Operation Monitoring

The delivery of Google DeepMind's Gemma 4 E2B model weights (~1.87 GB), tokenizer metadata, and WebAssembly execution binaries is governed by an Akamai-accelerated edge distribution pipeline designed to provide rapid, uninterrupted binary transmission directly to client browsers. This delivery infrastructure is actively monitored through a dedicated chunk-level watchdog telemetry system executing within the client browser. Rather than relying on monolithic, unmonitored file downloads that frequently stall or corrupt under volatile network conditions, the Akamai pipeline streams data in discrete binary chunks while continuously measuring real-time throughput, byte-by-byte transfer progress, and connection latency. The client watchdog enforces strict 35-second chunk timeout intervals alongside 60-second storage flush thresholds, immediately detecting packet stalls, transient dropped sockets, or edge throttle events.

When browser-enforced Cross-Origin Resource Sharing (CORS) constraints or restrictive corporate network proxies impede direct connection to public model repositories, the pipeline activates an automated edge-proxy failover route through the application's internal streaming endpoint. To safeguard local persistence integrity across Windows and Chromium environments, the storage monitor actively oversees filesystem handle transitions, purging orphaned temporary .crswap artifacts prior to write initialization, verifying directory handle permissions via the File System Access API, and executing seamless automatic failover to the Origin Private File System (OPFS) whenever desktop directory access is restricted. Each retrieved byte range undergoes continuous size verification against cryptographic artifact headers, preventing partial writes and guaranteeing that corrupt weight matrices never enter GPU compute memory.

Live Streaming Inference and Execution Monitoring

Once model weights are committed to local origin storage and mapped into graphics memory, the Google LiteRT-LM WebGPU execution runtime coordinates a token-by-token live streaming inference protocol that provides continuous visibility into repository scanning operations. As the multi-stage auditor parses complex CI/CD workflow trees and multi-ecosystem dependency manifests, the neural engine streams reasoning tokens asynchronously into the client interface, providing developers with live, real-time audit feeds, instantaneous risk classifications, and streaming remediation diffs rather than opaque, delayed batch reports. The streaming protocol monitors time-to-first-token latency, per-second token generation velocity, and parsing stage durations, allowing the interface to render smooth micro-animations and active step progression as every file is processed.

Underpinning the streaming inference protocol is an active WebGPU device and VRAM telemetry monitor that tracks hardware adapter health and compute pass execution. Because scanning dozens of large workflow YAML files, composite actions, and lockfiles within a single scan session can quickly saturate client GPU memory, the GitLatch execution supervisor implements an automated Key-Value (KV) cache reset protocol. After the neural audit of each individual file concludes, the supervisor disposes of prior conversation context, flushes the active KV cache buffers, and reallocates a pristine context window capped at 4096 input and 2048 output tokens. This prevents cumulative GPU out-of-memory errors, eliminates cross-file prompt bleeding, and guarantees consistent, deterministic audit accuracy across the entire repository lifecycle. Furthermore, the runtime continuously listens for catastrophic device.lost hardware disconnect signals, providing automated recovery pathways that gracefully alert the operator without freezing the client application.

MediScan : Your Medical Co-Pilot

Megh Deb — Sat, 17 Oct 2026 14:39:03 +0000

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 2: Side Hustle

What I Built

Every single year, millions of patients walk out of clinics and pathology laboratories holding crumpled pieces of paper that hold the key to their recovery, yet are completely indecipherable to them. Illegible medical penmanship, hurried physician notations, cryptic prescription abbreviations like OD, BD, TDS, AC, and HS, and dense diagnostic lab jargon—such as elevated transaminases, altered creatinine clearance, or fluctuating lipid fractions—frequently lead to severe medication administration errors, delayed clinical interventions, and profound patient anxiety. For elderly individuals, chronic patients managing polypharmacy, and anxious family caregivers, navigating physical prescriptions and laboratory slips is an agonizing ordeal that leaves them completely uninformed about what active chemical salt is entering their body, why a medicine was prescribed, how it interacts with food, whether their blood markers are within safe demographic boundaries for their age and gender, or what warning signs necessitate immediate medical attention.

To eliminate this diagnostic opacity once and for all, I built an executive-grade clinical intelligence platform named MediScan. MediScan transforms chaotic, illegible paper prescriptions and complex pathological laboratory reports into an empowering, highly legible, and structured digital healthcare companion that bridges the communication divide between doctors, pathologists, pharmacists, and everyday patients. Below is the dedicated breakdown of every core platform feature, detailing its specific healthcare requirement, functionality, and clinical advantages:

Prescription Handwriting OCR & Profile Extraction

Requirement: Physician handwriting is notoriously hurried and illegible, creating diagnostic ambiguities, patient misinterpretation, and a severe lack of structured digital records at the critical moment of discharge.
Description: MediScan utilizes frontier multimodal vision intelligence to process raw photos of handwritten or printed prescription slips, instantly isolating the prescribing physician's name, medical registration number, academic credentials, and clinic affiliation, alongside patient demographic details, physiological vitals (blood pressure, pulse rate, temperature, SpO2), and formal clinical diagnoses.
Advantages: Eliminates dangerous misreadings of medication names and clinical orders, creates an auditable electronic healthcare record, and ensures that all subsequent schedules are anchored to verified patient vitals.

Latin Shorthand Decoding into Daily Routine Timetables

Requirement: Cryptic Latin medical abbreviations such as OD, BD, TDS, QID, AC, PC, and HS routinely baffle patients, resulting in missed doses, improper food relationships, or accidental double-dosing that leads to hospitalization.
Description: This feature systematically translates obtuse medical shorthand into an intuitive, everyday Daily Medication Schedule cleanly separated into Morning (Breakfast), Afternoon (Lunch), and Night (Dinner/Bedtime) routines, detailing exact dose quantities and explicit food requirements (such as take 30 minutes before breakfast or take immediately after meals).
Advantages: Drastically reduces medication non-compliance, eliminates accidental overmedication, and allows elderly patients and non-medical caregivers to manage complex polypharmacy regimens with total autonomy and clarity.

Active Pharmacological Composition, Salt Strength & Patient Safety Rules

Requirement: Commercial brand names obscure the underlying active chemical molecules, making it easy for patients to unintentionally consume duplicate medications from different manufacturers, causing severe toxicity or missing critical contraindications.
Description: For every identified drug, MediScan cross-references clinical pharmacological knowledge to extract the authentic active chemical salts, exact salt strengths, primary therapeutic indications, and essential patient safety precautions (such as avoiding alcohol, not crushing delayed-release tablets, or drinking extra fluids).
Advantages: Prevents accidental drug overdoses and hazardous drug-drug interactions, demystifies why each medication is necessary, and promotes informed patient agency during medical therapy.

Geolocation-Aware Localized Pharmacy Availability & Live Pricing (SerpApi)

Requirement: Prescription drug pricing and retail availability are notoriously fragmented and non-transparent, forcing stressed patients or family members to visit multiple physical pharmacies during emergencies to find stock or overpay.
Description: Capturing browser geolocation coordinates with automated server-side reverse geocoding into canonical local cities and districts, MediScan queries SerpApi's Google Shopping engine in parallel across all detected medications to surface verified local online retailers, live stock availability, and genuine localized pricing in local currency with direct purchasing links.
Advantages: Delivers immediate financial transparency, eliminates unnecessary physical travel during acute illness, and establishes a seamless, frictionless bridge from clinical diagnosis to affordable medicine procurement.

Ordered Diagnostic Investigations & Preparation Guidelines

Requirement: Diagnostic tests ordered on prescriptions often lack preparation instructions, causing patients to arrive at diagnostic laboratories unprepared (such as failing to fast for blood glucose or lipid testing), leading to canceled appointments or inaccurate test results.
Description: The system automatically identifies all recommended blood tests, urine screenings, and radiological investigations from the prescription, explicitly outlining their clinical diagnostic purpose and mandatory pre-test preparation rules (including fasting durations and hydration guidelines).
Advantages: Eliminates wasted laboratory visits, guarantees test specimen accuracy, and accelerates the diagnostic timeline for ongoing patient monitoring.

Pathological Lab Report Layman Translation Engine

Requirement: Standard pathology laboratory sheets are filled with dense medical jargon and esoteric acronyms (such as SGOT, SGPT, Bilirubin Direct, Mean Corpuscular Volume) that provide no understandable context to everyday patients regarding what is actually occurring within their body.
Description: MediScan decodes complex medical test parameters into two accessible layman breakdowns: What This Test Actually Measures (explaining the underlying biological mechanism in simple words) and What This Portrays About Your Health (explaining whether the reading suggests normal organ function, cellular strain, systemic inflammation, or nutritional deficiency).
Advantages: Replaces medical anxiety with genuine comprehension, helps patients understand the functional health of their organs, and facilitates informed, confident dialogues between patients and doctors during follow-up visits.

Personalized Average Health Score Index (0–100) & Categorical Metric Tally

Requirement: Patients receiving multipage diagnostic lab slips often face dozens of discrete values and struggle to grasp their holistic health condition or determine which specific parameters require urgent medical intervention.
Description: The engine computes an intelligent, personalized Average Health Score (0 to 100) with intuitive clinical rating tiers (Optimal, Good, Needs Attention, Critical Attention), supported by a high-contrast metric counter tallying Total Parameters, Normal readings, Mild Deviations, and Priority Attention alerts.
Advantages: Provides an instant, understandable snapshot of overall health status, immediately highlights clinical priorities that warrant physician discussion, and motivates patients toward proactive lifestyle management.

Interactive Parameter Carousel Showcase

Requirement: Displaying dozens of dense pathology test cards on a single screen causes severe cognitive overload, visual exhaustion, and frustrating page scrolling for patients and caregivers.
Description: MediScan organizes all extracted parameters into an interactive, high-contrast, large-font Parameter Carousel. Patients navigate through tests one-by-one using Previous/Next action buttons, keyboard arrow shortcuts, a direct parameter selector dropdown, or compact numbered jump chips with color-coded status dots—with zero horizontal scrolling.
Advantages: Ensures optimal legibility for elderly users and visually impaired patients, provides dedicated focus on each test without clutter, and enables instant 1-click navigation to any parameter.

Demographic Reference Standards Comparison (Age & Gender Breakdown)

Requirement: Standard clinical reference ranges vary substantially based on biological sex (hormonal profiles, muscle mass) and age cohorts (pediatric, adult, geriatric), but physical lab slips frequently display only a single generalized adult standard.
Description: Every parameter is compared side-by-side against demographic benchmarks, featuring dedicated male vs. female standard ranges and comprehensive age bracket tables (e.g., children, adults, seniors), supplemented by regional reference standards notes.
Advantages: Empowers every reader to tally their personal findings against their exact age and sex cohort, preventing unwarranted panic over false alarms while ensuring genuine demographic deviations are promptly detected.

Evidence-Based Lifestyle Guidance & Physician Discussion Questions

Requirement: After receiving abnormal laboratory results, patients frequently feel abandoned between appointments, unsure of what daily nutritional habits to adopt or what specific questions to ask their physician.
Description: MediScan analyzes the aggregated pathological findings to synthesize actionable everyday dietary, hydration, and physical activity guidance, alongside targeted, high-yield questions tailored for the patient to bring directly to their doctor.
Advantages: Empowers patients with immediate, safe self-care habits, optimizes consultation efficiency during clinic visits, and deepens collaborative decision-making between patient and practitioner.

Executive Monochromatic Vector A4 PDF Export

Requirement: Mobile web interfaces are often inaccessible during physical doctor consultations or in hospital areas with limited network connectivity, while standard browser printouts suffer from broken page breaks and lack legal disclaimers.
Description: MediScan features an integrated document compiler utilizing jsPDF and jspdf-autotable that generates formal, hospital-grade monospace vector A4 PDF Clinical Transcripts for both prescriptions and pathology reports. Every cell border is explicitly drawn with grid lines, running headers/footers indicate confidentiality and page counts (PAGE X OF Y), and mandatory AI verification disclaimers are appended.
Advantages: Delivers an authoritative, archival-quality physical document that patients can print or share directly with their physician, fostering seamless clinical cross-verification while upholding legal safety standards.

Secure Credentials Authentication & Edge Route Defense (NextAuth & MongoDB Atlas)

Requirement: Personal medical prescriptions and pathological test reports constitute highly sensitive personal data that requires enterprise-grade access control and robust perimeter protection.
Description: Full user authentication is implemented with NextAuth.js backed by MongoDB Atlas, employing salted bcryptjs password encryption, real-time password visibility controls, and Edge middleware route defense that strictly enforces 24-hour authenticated JWT sessions across scanner views and analytical API routes.
Advantages: Safeguards patient confidentiality, prevents unauthorized data exposure, and provides a frictionless, reliable user authentication experience across all devices.

Demo

Experience the live application and test both prescription deciphering and pathology lab report analysis in real time:

Live Application Demo: https://mediscan-xi-seven.vercel.app

Code

The complete source code, architectural documentation, and environment configuration are available in the public repository:

Official GitHub Repository: https://github.com/Megh2005/dev-challange-2

How I Built It

The application is engineered from the ground up to adhere to strict production standards, prioritizing reliability, deterministic output, and exceptional user experience across all age demographics:

Next.js 14 App Router & TypeScript: Built on Next.js 14 with App Router, enforcing end-to-end type safety across all clinical data contracts. The interface is styled with solid-token Tailwind CSS featuring Roboto Slab typography on an intentional 80vw centered layout, eliminating distracting gradients, frivolous animations, and emojis in favor of a clean, high-contrast, accessible healthcare presentation.
Authentication & Secure Access (NextAuth & MongoDB Atlas): Full user authentication is implemented with NextAuth.js utilizing a credentials-based provider backed by MongoDB Atlas. Passwords are encrypted using salted bcryptjs hashing. Protected routes (including /scan, /reports, and analytical endpoints) are guarded via Next.js Edge middleware with 24-hour JWT session token verification, protocol-aware cookie handling, and registration flows with real-time password visibility toggling.
Multimodal AI Intelligence Layer: The clinical analysis pipelines utilize Google's frontier multimodal Gemini engines (@google/generative-ai). Files are ingested as native binary multipart form data directly into temporary disk streams via GoogleAIFileManager rather than degrading performance with base64 payloads. The models operate under strict JSON schema constraints, executing simultaneous handwriting deciphering, optical character recognition, abbreviation normalization, pathological metric extraction, and layman medical translation without relying on fragile local lookup tables.
Parameter Carousel & Demographic Standards Engine: Rather than overwhelming patients with dense grids of medical parameters, the pathology analyzer renders parameters in a focused, high-contrast Carousel Showcase. Users navigate with Previous/Next controls, keyboard arrow shortcuts, a direct parameter selector dropdown, or compact numbered jump chips with status indicator dots. Every parameter details what the test measures, what it portrays about the user's health, and explicit demographic comparisons (male vs. female standards and age bracket tables).
Localized Online Pharmacy Pricing (SerpApi): To address medication availability and price transparency, the platform integrates SerpApi's Google Shopping Engine. Browser geolocation coordinates are reverse-geocoded on the server into canonical local city and country parameters. The backend queries SerpApi in parallel across all identified medications, extracting verified local online retailers, product titles, delivery details, and authentic localized pricing in rupees or local currency, rendering direct purchasing links for immediate patient convenience.
Full-Stack Observability & Tracing (Sentry): System reliability, AI pipeline tracking, and exception telemetry are monitored with @sentry/nextjs. Dedicated Sentry instrumentation across client, server, and edge runtimes traces API response latencies, catches OCR parsing anomalies, and monitors AI agent lifecycles through comprehensive distributed spans and error boundaries.
Cloud Data Persistence (MongoDB Atlas): MongoDB Atlas serves as the primary document store, securely managing user accounts, authentication credentials, patient consultation histories, and clinical transcripts with enterprise-grade encryption at rest and in transit.
Monochromatic Vector A4 PDF Export: Client-side document generation is powered by jsPDF and jspdf-autotable, which compile both prescription decipher transcripts and pathology lab analyses into strictly monospace, monochromatic vector A4 PDFs. Every cell border is explicitly drawn with grid lines, text overflows are eliminated through dynamic line-wrapping calculations, and running page borders, page counts, and comprehensive AI verification disclaimers are automatically appended.

Why Does Open Innovation Matter?

Healthcare is fundamentally human, and open innovation is the only mechanism that prevents critical clinical technologies from becoming guarded, walled-garden monopolies accessible only to elite institutions. When intelligent diagnostic and transcription tools are built openly, developers across the globe can inspect the reasoning pipelines, identify biases, verify clinical safety constraints, and adapt tools for rural clinics, underserved languages, and overburdened public health systems. Open-weight innovation and transparent API architectures democratize medical comprehension, turning what was once an impenetrable scribble on a physician's pad or an intimidating laboratory sheet into accessible, actionable, life-saving knowledge for every patient regardless of socioeconomic background.

Prize Categories

This project is entered into the following partner prize categories:

Best Use of Sentry Agent Tracing
- Implements end-to-end full-stack observability with @sentry/nextjs across client components, API routes, and edge runtimes, tracking multimodal OCR pipeline durations, monitoring external API latencies, and providing robust exception capture across all prescription deciphering and pathology analysis operations.
Best Use of SerpApi
- Leverages SerpApi's Google Shopping API with automatic latitude and longitude coordinate resolution to fetch localized online pharmacy pricing, retailer availability, and direct purchasing links for every deciphered medication.
Best Use of MongoDB Atlas
- Utilizes MongoDB Atlas as the foundational cloud document database for persisting user authentication credentials with salted bcrypt encryption, managing user accounts, and storing clinical consultation records, transcribed prescription histories, and routine timetables with high availability and scalability.

ShramPark: Offline-First AI Engineering Companion

Megh Deb — Sun, 11 Oct 2026 13:47:46 +0000

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 1: Touch Grass

What I Built

ShramPark is an offline-first, mobile-responsive AI engineering companion and construction site safety platform. At its core is Raghav AI—an on-device structural engineering assistant built specifically for my civil engineer friend.

The Problem My Friend Faced

My friend works as a structural and site civil engineer on active, high-pressure infrastructure and building projects. He spends hours stationed deep underground in basement excavations, piling pits, tunnel shafts, and remote jobsites where cellular networks and internet connectivity drop to absolute zero.

On active sites, he constantly needs to:

Cross-reference complex Indian Standard (IS) codes (such as IS 456:2000 for reinforced concrete, IS 800:2007 for structural steel, IS 1893:2016 for seismic design, IS 875 for wind and structural loading, and IS 10262:2019 for concrete mix proportioning).
Perform step-by-step mathematical engineering calculations (limiting moment of resistance, shear capacity, development length, rebar curtailment, and deflection limits).
Adjust concrete pouring and curing regimes based on real-time micro-climate factors (temperature, relative humidity, wind speed) to prevent thermal cracking and plastic shrinkage as per IS 7861.
Inspect on-site craftsmanship (rebar placement, cover block clearances, shuttering verticality, honeycombing) and produce stamped technical audit sheets.

In deep basement pits with zero cell reception, conventional cloud-based AI tools are completely unusable. He needed an intelligent, reliable engineering co-pilot that lives directly on his device and never requires an internet connection to solve complex structural problems. To solve this, I built Raghav AI.

What ShramPark Does

Raghav AI (Offline On-Device Engineering Assistant): Runs Google's open-weight Gemma 4 E2B model 100% locally in the browser using LiteRT-LM and WebGPU. Named 'Raghav', this assistant acts as an on-site engineering colleague that performs limit-state RC beam/slab/column design, shear checks, development length derivations, and mix design checks completely offline with zero server roundtrips.
SiteVision (AI Quality & Safety Inspector): Computer vision diagnostics allowing engineers and supervisors to snap photos of rebar cages, shuttering, or freshly cast concrete to detect honeycombing, cover block placement errors, slurry leaks, and safety non-compliance.
Micro-Climate Engineering Personalization: Integrates live site geolocation and micro-climate data (ambient temperature, humidity, wind speed) to automatically calculate evaporation rates, adjust curing durations, and suggest plastic shrinkage precautions as per IS 7861.
Standardized PDF Engineering Memos: Generates client-side, formatted technical calculation reports and site inspection checklists with KaTeX mathematical formulas.
Tailored for 2 Core Site Roles: Streamlined explicitly for Supervisor (field safety and visual audits) and Engineer (structural derivations and IS compliance).

Demo

The application is deployed and ready to use live in the field:

Live Deployment URL: https://shrampark.vercel.app/

Core Workflows to Test:

/raghav: Initialize the on-device Gemma 4 E2B WebGPU engine (download once or select a local .litertlm artifact) for 100% offline civil engineering derivations and IS code calculations.
/sitevision: Perform image-based field inspections and generate automated IS code compliance checklists.

Code

Megh2005 / dev-challange-1

ShramPark is an offline-first, mobile-responsive AI engineering companion and construction site safety platform built specifically for my civil engineer friend, Raghav.

Error in user YAML: (<unknown>): mapping values are not allowed in this context at line 1 column 17

---
title: ShramPark: Offline-First AI Engineering Companion 'Raghav' Built for My Civil Engineer Friend
published: true
tags: devchallenge, weekendchallenge, hf26challenge
---

This is a submission for the Hacktoberfest Weekend Challenge: Build for a Friend

What I Built

The Problem My Friend Faced

On active sites, he constantly needs to:

Cross-reference complex Indian Standard (IS) codes…

View on GitHub

GitHub Repository: https://github.com/Megh2005/dev-challange-1

How I Built It

ShramPark is architected around open-weight on-device AI designed to withstand harsh, disconnected construction jobsite environments:

1. Open-Source & Open-Weight AI Architecture (Gemma + LiteRT-LM)

Model: Gemma 4 E2B (gemma-4-E2B-it-web.litertlm), Google's open-weight instruct model quantized and packaged for the LiteRT runtime.
Inference Runtime: LiteRT-LM (@litert-lm/core) executing client-side on-device inference via WebGPU.
Model Distribution: Hosted openly on Hugging Face (litert-community/gemma-4-E2B-it-litert-lm).
Zero Server Overhead: The model file is cached client-side using browser Cache Storage or loaded directly via the File System Access API from the user's hard drive. Inference consumes 0 server compute and transmits 0 bytes over the wire.
Engine Optimization: Configured with a 4096-token execution context and KV cache recycling to execute step-by-step mathematical proofs and limit-state safety factor derivations without GPU out-of-memory errors.

2. Full-Stack & Engineering Stack

Framework: Next.js 14 (App Router) with TypeScript and Tailwind CSS.
Multimodal Field Inspections: Google Generative AI (@google/generative-ai) for visual defect analysis and safety compliance audits in SiteVision.
Mathematical Typography: react-markdown, remark-math, rehype-katex, and katex for rendering complex civil engineering formulas and equations cleanly on mobile screens.
Audio & Accessibility: Speech synthesis APIs and Cloud Speech for hands-free audio playback on noisy sites.
Document Export: jspdf and @react-pdf/renderer for instant client-side generation of stamped site inspection logs and structural calculation sheets.
Database & Auth: MongoDB Atlas with @auth/mongodb-adapter and next-auth for role-based access control (Supervisor, Engineer).

Why Does Open Innovation Matter?

Open innovation is what made ShramPark viable for real-world construction:

True Offline Independence in Dead Zones:
Closed-source APIs require round-trip internet requests. On construction sites—inside double-basements, metro tunnels, rebar fabrication yards, or remote flyover sites—cellular signals are weak or non-existent. Open weights paired with LiteRT-LM allow my friend and site engineers to carry an entire structural engineering brain directly in their laptop or tablet browser without a single bar of cell reception.
Zero Incurred In-Field Costs:
Civil engineers, site supervisors, and independent contractors cannot afford recurring monthly API subscriptions or per-token fees for routine field calculations. Open-weight local inference delivers complete engineering calculations without recurring expenses.
Domain Ownership & Adherence to Local Standards:
Generalist closed APIs frequently default to foreign codes (ACI 318, Eurocodes, or British Standards). Open innovation enables us to constrain and instruct open weights exclusively on Indian Standards (Bureau of Indian Standards: IS 456:2000, IS 1893:2016, IS 800:2007, IS 10262:2019) with deterministic formatting and rigorous limit checks.
Privacy and Site Data Sovereignty:
Proprietary structural drawings, tender blueprints, and on-site defect photos remain strictly on the engineer’s machine, guaranteeing complete IP protection for builders and contractors.

My Agent Session

This project was developed with the assistance of agentic workflows in Google Antigravity, which accelerated:

Integration and debugging of @litert-lm/core WebGPU bindings and KV cache memory cleanup.
Prompt design for strict IS code adherence, mathematical formula formatting, and micro-climate contextualization.
Clean Next.js 14 architecture with responsive mobile layouts tailored for high-glare outdoor construction use.

Prize Categories

Best Build on Gemma: ShramPark harnesses Google's open-weight Gemma 4 E2B model running completely on-device in the browser via LiteRT-LM (@litert-lm/core) and WebGPU. By delivering 100% offline, zero-latency inference directly on client hardware, it solves the critical problem of cellular dead-zones in deep basement excavations and remote civil infrastructure projects, enabling step-by-step IS-code compliant structural calculations without ever pinging a cloud server.

ShramPark: Offline-First AI Engineering Companion 'Raghav' Built for My Civil Engineer Friend

Megh Deb — Fri, 02 Oct 2026 13:19:58 +0000

This is a submission for the Hacktoberfest Weekend Challenge: Build for a Friend

What I Built

The Problem My Friend Faced

On active sites, he constantly needs to:

Cross-reference complex Indian Standard (IS) codes (such as IS 456:2000 for reinforced concrete, IS 800:2007 for structural steel, IS 1893:2016 for seismic design, IS 875 for wind and structural loading, and IS 10262:2019 for concrete mix proportioning).
Perform step-by-step mathematical engineering calculations (limiting moment of resistance, shear capacity, development length, rebar curtailment, and deflection limits).
Adjust concrete pouring and curing regimes based on real-time micro-climate factors (temperature, relative humidity, wind speed) to prevent thermal cracking and plastic shrinkage as per IS 7861.
Inspect on-site craftsmanship (rebar placement, cover block clearances, shuttering verticality, honeycombing) and produce stamped technical audit sheets.

What ShramPark Does

Raghav AI (Offline On-Device Engineering Assistant): Runs Google's open-weight Gemma 4 E2B model 100% locally in the browser using LiteRT-LM and WebGPU. Named 'Raghav', this assistant acts as an on-site engineering colleague that performs limit-state RC beam/slab/column design, shear checks, development length derivations, and mix design checks completely offline with zero server roundtrips.
SiteVision (AI Quality & Safety Inspector): Computer vision diagnostics allowing engineers and supervisors to snap photos of rebar cages, shuttering, or freshly cast concrete to detect honeycombing, cover block placement errors, slurry leaks, and safety non-compliance.
Micro-Climate Engineering Personalization: Integrates live site geolocation and micro-climate data (ambient temperature, humidity, wind speed) to automatically calculate evaporation rates, adjust curing durations, and suggest plastic shrinkage precautions as per IS 7861.
Standardized PDF Engineering Memos: Generates client-side, formatted technical calculation reports and site inspection checklists with KaTeX mathematical formulas.
Tailored for 2 Core Site Roles: Streamlined explicitly for Supervisor (field safety and visual audits) and Engineer (structural derivations and IS compliance).

Demo

The application is deployed and ready to use live in the field:

Live Deployment URL: https://shrampark.vercel.app/

Core Workflows to Test:

/raghav: Initialize the on-device Gemma 4 E2B WebGPU engine (download once or select a local .litertlm artifact) for 100% offline civil engineering derivations and IS code calculations.
/sitevision: Perform image-based field inspections and generate automated IS code compliance checklists.

Code

Megh2005 / dev-challange-1

ShramPark is an offline-first, mobile-responsive AI engineering companion and construction site safety platform built specifically for my civil engineer friend, Raghav.

Error in user YAML: (<unknown>): mapping values are not allowed in this context at line 1 column 17

---
title: ShramPark: Offline-First AI Engineering Companion 'Raghav' Built for My Civil Engineer Friend
published: true
tags: devchallenge, weekendchallenge, hf26challenge
---

This is a submission for the Hacktoberfest Weekend Challenge: Build for a Friend

What I Built

The Problem My Friend Faced

On active sites, he constantly needs to:

Cross-reference complex Indian Standard (IS) codes…

View on GitHub

GitHub Repository: https://github.com/Megh2005/dev-challange-1

How I Built It

ShramPark is architected around open-weight on-device AI designed to withstand harsh, disconnected construction jobsite environments:

1. Open-Source & Open-Weight AI Architecture (Gemma + LiteRT-LM)

Model: Gemma 4 E2B (gemma-4-E2B-it-web.litertlm), Google's open-weight instruct model quantized and packaged for the LiteRT runtime.
Inference Runtime: LiteRT-LM (@litert-lm/core) executing client-side on-device inference via WebGPU.
Model Distribution: Hosted openly on Hugging Face (litert-community/gemma-4-E2B-it-litert-lm).
Zero Server Overhead: The model file is cached client-side using browser Cache Storage or loaded directly via the File System Access API from the user's hard drive. Inference consumes 0 server compute and transmits 0 bytes over the wire.
Engine Optimization: Configured with a 4096-token execution context and KV cache recycling to execute step-by-step mathematical proofs and limit-state safety factor derivations without GPU out-of-memory errors.

2. Full-Stack & Engineering Stack

Framework: Next.js 14 (App Router) with TypeScript and Tailwind CSS.
Multimodal Field Inspections: Google Generative AI (@google/generative-ai) for visual defect analysis and safety compliance audits in SiteVision.
Mathematical Typography: react-markdown, remark-math, rehype-katex, and katex for rendering complex civil engineering formulas and equations cleanly on mobile screens.
Audio & Accessibility: Speech synthesis APIs and Cloud Speech for hands-free audio playback on noisy sites.
Document Export: jspdf and @react-pdf/renderer for instant client-side generation of stamped site inspection logs and structural calculation sheets.
Database & Auth: MongoDB Atlas with @auth/mongodb-adapter and next-auth for role-based access control (Supervisor, Engineer).

Why Does Open Innovation Matter?

Open innovation is what made ShramPark viable for real-world construction:

True Offline Independence in Dead Zones:
Closed-source APIs require round-trip internet requests. On construction sites—inside double-basements, metro tunnels, rebar fabrication yards, or remote flyover sites—cellular signals are weak or non-existent. Open weights paired with LiteRT-LM allow my friend and site engineers to carry an entire structural engineering brain directly in their laptop or tablet browser without a single bar of cell reception.
Zero Incurred In-Field Costs:
Civil engineers, site supervisors, and independent contractors cannot afford recurring monthly API subscriptions or per-token fees for routine field calculations. Open-weight local inference delivers complete engineering calculations without recurring expenses.
Domain Ownership & Adherence to Local Standards:
Generalist closed APIs frequently default to foreign codes (ACI 318, Eurocodes, or British Standards). Open innovation enables us to constrain and instruct open weights exclusively on Indian Standards (Bureau of Indian Standards: IS 456:2000, IS 1893:2016, IS 800:2007, IS 10262:2019) with deterministic formatting and rigorous limit checks.
Privacy and Site Data Sovereignty:
Proprietary structural drawings, tender blueprints, and on-site defect photos remain strictly on the engineer’s machine, guaranteeing complete IP protection for builders and contractors.

My Agent Session

This project was developed with the assistance of agentic workflows in Google Antigravity, which accelerated:

Integration and debugging of @litert-lm/core WebGPU bindings and KV cache memory cleanup.
Prompt design for strict IS code adherence, mathematical formula formatting, and micro-climate contextualization.
Clean Next.js 14 architecture with responsive mobile layouts tailored for high-glare outdoor construction use.

Prize Categories

Best Build on Gemma: ShramPark harnesses Google's open-weight Gemma 4 E2B model running completely on-device in the browser via LiteRT-LM (@litert-lm/core) and WebGPU. By delivering 100% offline, zero-latency inference directly on client hardware, it solves the critical problem of cellular dead-zones in deep basement excavations and remote civil infrastructure projects, enabling step-by-step IS-code compliant structural calculations without ever pinging a cloud server.