Andre Kanmegne

• Automation & Development: Built Python automation for claims processing and business workflows, cutting manual batch handling (~70% faster claims-invoice cycle) and improving data quality; added automated QC reports and dashboards that removed recurring manual checks for the Finance team.
• Business Applications & ITSM: Administered and supported 8+ critical enterprise applications used by the Claims, Underwriting, Finance and HR teams, and administered the GLPI ITSM platform — contributing to its functional and technical evolution.
• Cloud & Modern Workplace: Contributed to the group’s workplace-cloudification programme (Windows 365 / Global Cloud Desktop, Microsoft Intune) through testing, validation and user-adoption support, and supported on-premise→Azure application migration.
• IAM & IT Operations: Managed business roles and access for several hundred users across enterprise applications, handled full onboarding/offboarding, and resolved N2/N3 incidents in coordination with HR and the central German teams.
• IT Projects & AI Transformation: Coordinated IT actions between the French and German (HDI Group) teams, produced user procedures and technical documentation, and scoped a prototype AI integration for the ITSM platform to improve support and knowledge management.

• ETL Pipelines: Built data scraping and extraction pipelines (Python, BeautifulSoup) to automate business intelligence gathering, saving several hours of manual work per week.
• Frontend Refactor: Refactored UI across a hybrid stack (React, TypeScript, Laravel) and applied rendering and asset optimizations to improve Core Web Vitals scores.

State-recognised Bac+5 (RNCP Level 7) covering fullstack development, DevOps, cloud infrastructure, software architecture, and enterprise systems. Core modules: React, Node.js, Next.js, Docker, Kubernetes, GitHub Actions, Azure, Software Architecture, Agile/Scrum, AI & Data Science, Application Security.

Production-grade enterprise Kubernetes platform on a self-hosted cluster simulating the complete information system of a B2B French insurance company (ktayl solution). 90+ delivery phases, 54+ active workloads across 15 IS domains: policy management, claims, underwriting, ERP/finance, AI governance, communication, document management, compliance (ACPR/DORA), and workplace AI (minicloud Copilot). GitOps-delivered via ArgoCD app-of-apps, hardened with zero-trust NetworkPolicy, OPA Gatekeeper deny-mode admission control, and full supply-chain security.

• Enterprise GitOps: ArgoCD app-of-apps, Kustomize base+overlays (dev/staging/prod), CI promote dev-only, PR-gated staging+prod, AppProject with locked sourceRepos and clusterResourceWhitelist
• OPA Gatekeeper deny-mode — zero violations — NET_RAW, capabilities, seccomp, privilege escalation, host namespace; Falco runtime security
• Zero-trust NetworkPolicy across all namespaces; Cilium eBPF CNI + Hubble observability; Authentik OIDC SSO + TOTP for all 54+ services
• AI Gateway: LiteLLM + vLLM (on-cluster inference) + minicloud-crew-agent (LangGraph multi-agent) + minicloud-agent (ReAct research agent) + Flowise + MLflow; Langfuse LLMOps; Qdrant vector DB
• Enterprise RAG: bge-m3 embeddings + Qdrant HNSW + BM25 hybrid search (French tokenizer) + cross-encoder re-ranking + markitdown-proxy OCR — fully in-cluster, 0 external API calls
• Insurance IS: ERPNext HR + French PCG 2025 (845 accounts) + TSCA tax templates + Factur-X Minimum + LOB hierarchy (IARD + Vie & Prévoyance); Stalwart mail + Matrix + Jitsi + Nextcloud + OnlyOffice
• minicloud Copilot (M365 equivalent): Email AI (Stalwart→LiteLLM triage), Meeting notes (Jitsi→Whisper→LiteLLM), Document grounding (Nextcloud→RAG→Qdrant), Chat AI (Matrix bot), Enterprise Search (Open WebUI+Qdrant)
• ToyotaGPT agent factory architecture: standardised AI gateway + LangGraph agents + Langfuse observability + RAG + markitdown-proxy — 6 months→4 days agent delivery model
• Full supply chain: Cosign keyless signing, syft CycloneDX SBOM, Trivy CVE scan, GPG commits, branch protection, Dependabot

Technologies: k3s (Kubernetes, 5 nodes), ArgoCD (app-of-apps), Helm / Kustomize, HashiCorp Vault + ESO, Authentik (OIDC/SSO), OPA Gatekeeper + Falco, Cilium eBPF + Hubble, Prometheus / Grafana / Loki / Tempo, LiteLLM (AI Gateway), vLLM (on-cluster inference), Qdrant (vector DB), minicloud-crew-agent (LangGraph), minicloud-agent (ReAct), Flowise + MLflow, Langfuse (LLMOps), ERPNext (French PCG 2025 + TSCA + Factur-X), Temporal (workflow orchestration), n8n (business automation), Stalwart mail + Matrix + Jitsi, Nextcloud + OnlyOffice, Backstage (IDP), Harbor, Longhorn + Velero + MinIO, NATS JetStream / KEDA, Ansible / OpenTofu / MAAS, Tailscale + Cloudflare Tunnel

Domain-restricted AI financial assistant with a production PromptOps architecture. Built a LiteLLM CustomLogger (LangfusePromptHandler) that fetches the active production-labelled prompt from Langfuse at request time with 5-minute in-process cache and a three-layer fail-open chain — enabling instant prompt rollbacks without code deploys or image rebuilds. Includes a 25-case CI eval suite enforcing 100% pass rate as a deployment gate.

• XML-structured Modelfile: 5 behavioral sections (system_intent, domain_constraints, safety_guardrails, jailbreak_defenses, output_format) — explicit prompt architecture, not a single instruction block
• 5 jailbreak defense patterns: FIXED RUNTIME, UNTRUSTED INPUT, INJECTION RESPONSE, PROMPT ISOLATION, PERSISTENCE — covers roleplay, system override, credential phishing, translation bypass
• LangfusePromptHandler: runtime prompt injection via LiteLLM CustomLogger (async_pre_call_hook) — instant rollback, zero redeploy
• 25-case eval suite across 5 behavioral categories — 100% pass rate enforced as deployment gate, weekly scheduled baseline run
• Semantic versioning (MAJOR/MINOR/PATCH) + CI auto git-tagging + fail-open chain: Langfuse → stale cache → env var

Technologies: Groq llama-3.1-8b-instant (primary), Ollama phi4-mini ×3 (fallback), LiteLLM (routing + CustomLogger), Langfuse (Prompt Management + Tracing), Python, GitHub Actions (Eval CI), Kubernetes (k3s), Presidio (PII/DLP guardrail), Valkey (prompt cache)

Built a full multilingual RAG pipeline for French insurance document retrieval across three custom-built repos. minicloud-markitdown-proxy (FastAPI): routes documents by type — PDF/images to Docling OCR, Office/HTML to MarkItDown in-pod — exposing a Docling-compatible API surface. minicloud-rag-ingest (FastAPI): full ingestion pipeline in one HTTP endpoint — convert → structure-aware heading chunk (French insurance regex) → bge-m3 1024-dim embed → pgvector HNSW INSERT. minicloud-postgresql-noavx512: custom PostgreSQL image with pgvector's vector.so rebuilt without -mavx512f/bw/vl/dq to fix a SIGILL crash on i7-8565U/i7-10510U CPUs caused by AVX-512 EVEX instructions in pgvector 0.8.4. Hybrid search layer: BM25 with French Snowball stemmer + NLTK stop-words injected via init container patching rank_bm25/utils.py at pod start. Cross-encoder re-ranking (ms-marco-MiniLM-L-6-v2) filters to top-3.

• minicloud-markitdown-proxy: PDF/images → Docling OCR, Office/HTML → MarkItDown in-pod (Docling-compatible API)
• minicloud-rag-ingest: single HTTP endpoint — convert → chunk → bge-m3 embed → pgvector HNSW INSERT
• minicloud-postgresql-noavx512: vector.so rebuilt without AVX-512 — fixed SIGILL on i7-8565U/i7-10510U (pgvector 0.8.4 SIMD bug)
• French BM25: NLTK Snowball stemmer + insurance stop-words patched into rank_bm25 via Kubernetes init container
• Hybrid retrieval: bge-m3 1024-dim vector + BM25 + cross-encoder re-ranking (ms-marco-MiniLM-L-6-v2, top-3)
• Supply chain: Dockerfile + GitHub Actions CI + cosign keyless signing on both microservices
• Generation step routed through Enterprise AI Gateway (LiteLLM) — RAG retrieval + cloud/local model selection in one pipeline

Technologies: Python, FastAPI, PostgreSQL + pgvector (custom noavx512 build, C / Makefile), bge-m3 (Ollama), Docling (OCR/PDF), MarkItDown, rank_bm25 + NLTK (French BM25), ms-marco-MiniLM-L-6-v2 (cross-encoder), Docker, GitHub Actions, cosign, Kubernetes init containers

Multi-provider LLM routing and enterprise governance platform built on LiteLLM on Kubernetes. Unified 8 cloud and local providers (Groq, OpenAI, Gemini, DeepSeek, Mistral, Anthropic Claude, HuggingFace featherless-ai via router.huggingface.co, and local Ollama) behind a single API endpoint with intelligent fallback routing (Ollama→Groq→DeepSeek), Presidio PII/DLP scrubbing, 3-tier department key governance with per-dept budget caps and model allowlists, circuit breaker protection, Valkey prompt cache, and full Langfuse LLMOps tracing. Cost visibility delivered via a Grafana dashboard reading LiteLLM's PostgreSQL usage tables. Includes Langfuse v3.201.1 with ClickHouse analytics backend and Authentik OIDC SSO, plus an NVIDIA NIM tier (nemotron-70b, llama-8b, deepseek-r1).

• 8-provider routing: Groq, OpenAI, Gemini, DeepSeek, Mistral, Anthropic Claude, HuggingFace featherless-ai, Ollama — single LiteLLM endpoint
• Intelligent fallback chain: Ollama → Groq → DeepSeek — automatic failover on provider unavailability
• Presidio PII/DLP guardrail — pre-call PII masking with financial-context entity allow-list (years, locations, URLs excluded)
• 3-tier department key governance: per-dept budget caps, model allowlists, and usage quotas
• Circuit breaker (cooldown=60s, allowed_fails=3) + Valkey prompt cache (exact-match, 600s TTL) — resilience and cost optimisation
• Langfuse LLMOps (v3.201.1 + ClickHouse + Valkey + Authentik OIDC) + Grafana cost dashboard via PostgreSQL SQL

Technologies: LiteLLM (AI Gateway), Presidio (PII/DLP), Valkey (prompt cache), Langfuse v3.201.1 (LLMOps), ClickHouse (Langfuse analytics), Grafana (cost dashboard), PostgreSQL (usage data), Ollama (local inference), Python, Kubernetes (k3s), Authentik (OIDC/SSO), GitHub Actions

Deployed Open WebUI as a production enterprise AI chat interface serving 16 business departments through Authentik OIDC SSO. Connects the full AI backend stack — LiteLLM AI Gateway (8 providers), RAG pipeline (French insurance knowledge base), and SearXNG real-time web search — into a single product accessible to non-technical business users. phi3-financial serves as the default model for finance analysts, domain-restricted and prompt-governed at runtime via Langfuse. Conversation history and user management backed by PostgreSQL for production-grade persistence.

• Authentik OIDC SSO — 16 department groups, per-dept model defaults, conversation isolation enforced by design
• phi3-financial default for finance — domain-restricted, runtime prompt injection via Langfuse (instant rollback, no redeploy)
• Enterprise RAG in chat — French insurance knowledge base queryable via bge-m3 hybrid search + cross-encoder re-ranking
• SearXNG real-time web search — self-hosted meta-search, no tracking, globe icon in chat UI
• PostgreSQL conversation persistence — production-grade, migrated from SQLite, zero data loss on pod restart
• SSL CA bundle init container — solved OIDC token/JWKS SSL verification failure against self-signed cluster CA

Technologies: Open WebUI, Authentik (OIDC/SSO), LiteLLM (AI Gateway), Ollama (local model serving), SearXNG (web search), PostgreSQL (persistence), pgvector + bge-m3 (RAG), Langfuse (prompt management), Kubernetes (k3s), Helm

Production-hardened Internal Developer Portal built on Backstage 1.52, deployed on a self-hosted Kubernetes cluster with GitOps delivery, Authentik OIDC SSO, Software Templates, TechDocs, and a custom Plane Issues plugin.

• Software Catalog — all cluster workloads tracked: AI/ML services (RAG pipeline, AI gateway, Open WebUI, phi3-financial), platform tools (IDP, project tracker, password manager), CI/CD services (platform-demo, ktayl-solution-web), infrastructure (Nextcloud, OnlyOffice), and APIs — with owner, system, lifecycle, and tag metadata
• API Docs — inline Swagger/OpenAPI UI rendered for every registered API entity (e.g. rag-ingest-api: GET /health, POST /ingest)
• Kubernetes live view — real-time pod count and error status per component pulled from the live k3s cluster
• Custom Tech Radar — 4-quadrant radar (Platforms, AI & ML, Security, Languages) with 39 technology entries, fetched live from minicloud-gitops with no rebuild required
• Software Templates — golden-path go-service scaffolder; generates GitHub repo, CI pipeline, GitOps manifests, and ArgoCD app in one click
• TechDocs — in-portal documentation rendered from mkdocs.yml per service; mkdocs-techdocs-core baked into the Backstage image
• Plane Issues tab — custom @internal/plugin-minicloud-plane plugin showing live Plane CE project issues per catalog entity
• Authentik OIDC SSO — single sign-on via Authentik; no separate Backstage user accounts; TOTP enforced
• GitOps CI/CD — Trivy CVE scan + Cosign keyless signing + syft CycloneDX SBOM on every image; GPG-signed gitops bump; ArgoCD Recreate rollout

Technologies: Backstage 1.52, TypeScript, React, Node.js, ArgoCD, Authentik OIDC, Harbor, Cosign (keyless), Trivy, syft (SBOM), PostgreSQL, k3s, Tailscale, mkdocs-techdocs-core, Plane CE