Arizona, USA → Dar es Salaam, Tanzania.
I build and run software end to end, and mostly solo — schema, API, mobile client, the servers it runs on, and the generation pipelines around them.
Most of it is aimed at East Africa, where the constraints are real and different: prepaid data users pay for by the megabyte, Android phones two generations back, patchy connectivity, and a market mobile money reaches but cards do not. Those constraints tend to pick the architecture.
KaziLaw — Tanzanian labour-law Q&A and compliance checks. Live. Retrieval over a pgvector corpus of Tanzanian legislation with citations back to source, per-report licensing with an issuance ledger, and a generated compliance report. Built against a regulatory line: it answers questions about the law and never gives legal advice, and the disclosure layer is server-side and non-overridable rather than a footer somebody can forget.
Sema — a WhatsApp AI agent for small businesses in East Africa, in English or Swahili. Backend · Mobile client
The interesting problem is not generating replies, it is constraining them. Fourteen industries ship as versioned knowledge packs, each declaring what the agent may never invent and what must escalate to a human. The pharmacy pack forbids dosage, side effects, drug interactions and diagnosis, and escalates on adverse reactions and medication errors. On top of that, the context builder walks every required onboarding field the business left blank and injects that list into the system prompt — so the model is told explicitly which facts it does not have. Hallucination control by disclosure rather than by hope. Businesses upload a PDF price list or a photo of a menu; OCR and scraping turn it into catalogue.
routine-engine — a deterministic strength-training program generator, MIT, 25 tests, no runtime dependencies. Programs by movement pattern rather than muscle, so one plan serves a full gym and a bare floor. Exercises rotate per four-week block, not weekly, because weekly rotation makes progressive overload impossible to measure. Every pick is a pure function of a seed, so a program is stable offline and reviewable a week ahead. Extracted from Chuma.
Dino IG — a social app where the accounts are dinosaurs and they answer back in character. 311 species with feeds, comment threads and chat. Contract-first monorepo: one OpenAPI document generates the Zod schemas, the typed React Query client and server validation, so a renamed field breaks the build instead of a user's screen. Layered guardrails on the model — bounded input, a persona assembled per request from the database row, and a separate tighter rate budget for the surface that costs money. Fossil images resolve through a three-stage Wikipedia/Commons fallback, then localise to static files so the app stops hitting Wikimedia at all.
Chuma — a Swahili-first workout app for East Africa. (Private while a licensed exercise dataset lives in the repo; the engine above is the open part.)
Fail closed. A missing API key in production should crash the process at boot, not start a server with open write routes.
Bound everything at the edge. Message length, history depth, payload size, requests per surface. Separate rate budgets per endpoint, because a like-spam loop should not be able to starve the endpoint that bills.
Trust facts over claims. A content-length header is a claim — check the
buffer too. A test that greps a PDF buffer for text can match metadata and pass
while the document renders on zero pages; I shipped that false positive once and
now decode content streams properly.
Verify by probing, not by reading config. Rate limiting sat silently disabled in production for months on one project, because the table it depended on had never been created and it failed open. It read as configured. It wasn't.
Make the constraint pick the design. Caching every asset permanently on device began as a way to protect an API quota. The quota later went away and the cache mattered more, because re-downloading a 280 KB animation spends a user's airtime.
TypeScript · Node · React Native / Expo · Next.js · Express · PostgreSQL · Prisma · Drizzle · pgvector · Supabase · Zod · OpenAPI/Orval Self-hosted on Hetzner — nginx, systemd, Docker, Grafana LLM and diffusion pipelines — retrieval with citation, self-hosted ComfyUI workflows, LoRA training on an RTX 4000 Ada
📍 Dar es Salaam · kazilaw.com