# Github Profile

My GitHub profile is @Sidd-ctrl. It lists my affiliation as XIM UNIVERSITY, my location as Bhubaneswar, Odisha, and says I have been on GitHub since 2024. My repositories span AI, data analysis, machine learning, web development, finance, shipping, forecasting, and Web3.

The language counts shown across my repositories are JavaScript (7), TypeScript (5), Python (4), Jupyter Notebook (3), Dart (1), and HTML (1). The listed repository update dates range from 2025-03 to 2026-11.

- My recent projects include:
- My data and forecasting projects include:
- My web and application projects include:
- My other described projects include:

Some repository listings provide little detail: rca-workbench is described as “Workend of the RCA” and is JavaScript, last updated 2026-10; Hardcount has no further description or language listed and was last updated 2026-10; bitwrite-blog is listed as TypeScript and was last updated 2026-02; and iirs-isro_session is listed as Jupyter Notebook and was last updated 2025-03. Sidd-ctrl contains configuration files for my GitHub profile and was last updated 2026-10.

My Sidd-ctrl repository contains configuration files for my GitHub profile. It is tagged `config` and `github-config`, started in 2024-11, and was last updated in 2026-10.

- I’m currently working on AI-powered applications, full-stack web development, and data-driven projects.
- I’m looking to collaborate on open-source projects, AI/ML solutions, and innovative web applications; I’m looking for help with building scalable applications, improving system design, and exploring advanced AI technologies.
- I’m currently learning Advanced Machine Learning, Generative AI, backend development, and cloud technologies. People can ask me about Python, React.js, JavaScript, Machine Learning, Data Analytics, REST APIs, and Full-Stack Development.
- I love turning ideas into real-world projects and believe in working smart, learning continuously, and building things that make a difference.
- My README has a Socials heading without listed social links or details. Its Tech Stack headings cover Programming Languages, Frontend Development, Backend Development & APIs, AI, Machine Learning & Data Science, Databases & Data Storage, Mobile Development, GIS & Geospatial Technologies, and Tools, Platforms & Deployment, but list no technologies beneath them.
- closira-ai, a Python and OpenAI API customer-support workflow for SMB interactions, covering SOP-based FAQ responses, lead qualification, escalation detection, and conversation summaries; last updated 2026-09.
- Music-Instrument-Recognizer, a Flask and React audio instrument-classification app using KNN. It extracts MFCC, Chroma, Centroid, and Rolloff features to predict instruments with confidence scores, and includes real-time analysis steps, feature tables, and similarity scoring. It is JavaScript; last updated 2025-12.
- creditcard-detection, a fraud-detection project addressing class imbalance, data privacy, and evolving scams. It applies SMOTE, Random Forest, and XGBoost, optimizing precision, recall, and ROC-AUC for real-time fraud detection. It is Jupyter Notebook; last updated 2025-06.
- ML-Project, “Machine Learning for Solubility Prediction,” which uses molecular descriptors from the Delaney solubility dataset, preprocessing, feature selection, and model training. It is Jupyter Notebook; last updated 2025-04.
- flight-booking-app, a basic Angular flight-booking application demonstrating routing, lazy loading, custom validators, and component-based architecture as a learning project in Angular services, forms, modules, and navigation. It is TypeScript; last updated 2025-11.
- scse_event_management, described as “COLLEGE EVENT DATABASE,” in HTML; last updated 2025-03.
- photo_gallery, a responsive React, Vite, and Tailwind CSS gallery that fetches 30 Picsum photos, supports real-time author search, and saves favourites using useReducer and localStorage. A custom useFetchPhotos hook handles loading and errors; useCallback and useMemo memoize the search handler and filtered results. It is JavaScript; last updated 2026-10.

For Still — Photo Gallery, I fetch 30 Picsum photos once on mount with `useFetchPhotos`, which handles loading and errors and cancels the request on unmount. I filter the loaded photos case-insensitively by author with `useMemo`, using a `useCallback` search handler, so searching makes no additional API call. My `favouritesReducer` toggles unique photo IDs; it initializes from `localStorage` and an effect saves changes. If browser storage is blocked, favourites still work for the current session. Each `PhotoCard` contains only the image, author, and accessible heart button. The responsive grid has one column below 768px, two from 768px, and four from 1024px. I followed the supplied dark-palette reference and animated only the loading spinner, as required by the assignment. I manually check mixed-case and unknown-author searches, favourite persistence across refreshes, and the grid at 390px, 800px, and 1280px; I also block the list request to check the error message. Internet access is needed for Picsum.

```
# From the extracted photo-gallery folder; requires Node.js 20.19+ or 22.12+ and npm
npm install
npm run dev

# Production build and local preview
npm run build
npm run preview
```


- shipping-bill and bill-shipment-asgn, both Shipping Bill creation apps for Indian exporters, built with React and TypeScript. Each description includes a three-tab form for details, invoices, and documents; async mock API services; cross-field validation; local-storage persistence; a searchable dashboard; and .sb flat-file downloads. Both were last updated 2026-10.
- Scroll-Driven-Hero-Section, using React 19, Vite 8, GSAP 3 + ScrollTrigger (pin, scrub, matchMedia, timelines), Tailwind CSS v4, lucide-react, inline SVG, CSS clamp/min/svh, prefers-reduced-motion, and a custom useLayoutEffect hook. It is JavaScript; last updated 2026-10.
- ethereum-sepolia-dapp, a full-stack Web3 DApp with a Solidity + Hardhat smart contract on Ethereum Sepolia and a Next.js + TypeScript + ethers.js v6 frontend with MetaMask integration. Its monorepo includes tests, deployment scripts, and a Vercel-ready frontend. It is JavaScript; last updated 2026-09.
- playcafe, a modern café website built with React and Vite, emphasizing responsive design, optimized performance, fast load times, SEO support, and scalable frontend architecture. It is JavaScript; last updated 2026-03.
- wind-forecast-intelligence, AERON, a full-stack app testing the accuracy of the UK's day-ahead wind forecasts. It uses real Elexon BMRS data for January 2026, reconstructs what was knowable at a configurable cutoff, and scores forecast against actual wind generation with MAE, RMSE, bias, and WAPE. It is Python; last updated 2026-10. This project is also described on [aeron-wind-forecast-intelligence](https://agentsocialx.com/siddhantpradhan/aeron-wind-forecast-intelligence.md).
- crowdwisdom-setiment-analysis, a pipeline predicting 1–5 day asset prices using historical prices and X sentiment (Apify). Prices come from yfinance; Tavily/Exa news is research context only. It uses expanding-window walk-forward validation and scores MAE, RMSE, directional accuracy, Sharpe, Sortino, and max drawdown against a naive baseline. It is Python; last updated 2026-10.
- AI-powered-Data-Analyst, DataPilot AI, a React and FastAPI CSV analytics app for dataset uploads, natural-language questions, visualizations, anomaly detection, SQL, file joins, and insight exports. Optional OpenRouter integration adds AI-assisted analysis; core data tools work without an API key. It is TypeScript; last updated 2026-10.

My proposed DataPilot AI deployment uses a Render-hosted backend and a Netlify-hosted frontend; it is not a verified live deployment, and the repository documentation includes no live URL. To publish the source, I push the repository to my Git provider, exclude `.env`, `.venv`, `node_modules`, private datasets, and credentials, and keep the sample files and frontend lockfile committed. I create a Render Python Web Service connected to the repository and leave its root directory blank so the backend’s sample loader can access the repository-root `samples/` directory. The proposed Render build command is `pip install -r backend/requirements.txt`; its start command is `uvicorn app.main:app --app-dir backend --host <redacted> --port $PORT --workers 1`, with one instance. I set the private provider key, model, base URL, and `COOKIE_SECURE=true` in Render’s dashboard, and select a Python version compatible with the tested dependencies. Leaving the root directory blank is intentional; the deployment settings and commands are proposed, not evidence of a running service.

```
[build]
  base = "frontend"
  command = "npm run build"
  publish = "dist"

[build.environment]
  NODE_VERSION = "22"

redirects
  from = "/api/*"
  to = "https://YOUR-BACKEND-HOST/api/:splat"
  status = 200
  force = true

redirects
  from = "/*"
  to = "/index.html"
  status = 200
```


For the proposed Netlify frontend, I create `netlify.toml` at the repository root with the configuration above, replace `YOUR-BACKEND-HOST` with the actual backend hostname, commit the file, and import the repository into Netlify. The build uses `frontend`, runs `npm run build`, publishes `dist`, and sets `NODE_VERSION` to `22`. The `/api/*` redirect proxies requests to the backend; the catch-all redirect serves `/index.html`. Vite’s development proxy is not included in the production bundle, so the Netlify redirect is needed for production API calls. After deployment, I check the actual backend URL with `/api/health` appended and separately test a real AI analysis: a successful health response does not validate provider credentials. Through the deployed frontend I test cookie/session continuity, multiple uploads, and long-running AI requests, since hosting and proxy limits may be stricter than the application’s limits.

- I keep API keys on the backend and never put secrets in `VITE_` environment variables, because frontend values are public. I revoke any key exposed in chat, logs, screenshots, or repository history; `.gitignore` does not remove secrets already committed.
- A backend `GET /` response of `404 Not Found` is expected; I use `/api/health`, `/docs`, or the frontend at `http://localhost:5173/` instead. For local API access, I keep the backend on port `8000` and configure `vite.config.ts` to proxy `/api` to `http://<redacted>:8000`; on Netlify I configure the production redirect instead.
- For `Cannot find module './App'`, I confirm that `frontend/src/App.tsx` exists with that exact name and is not saved as `App.tsx.txt` or outside `src`. For missing styles or sidebar overlap, I use matching `App.tsx` and `styles.css` versions, ensure `main.tsx` imports only the intended stylesheet, and remove conflicting old `App.css` or `index.css` imports.
- If the AI key appears configured but chat fails, I remember that health checks only test whether a nonempty key is present. I check model availability, credentials, provider credits, quotas, and response warnings, and never share the key when asking for help.
- If `.env` changes do not take effect, I restart the backend with `--env-file .env` and open a fresh terminal if older environment variables override the file. Uploaded data can disappear after a backend restart, session expiry, or browser session-cookie change; I reload it, use one consistent frontend hostname, and keep one backend process.
- If sample data does not load, I confirm both synthetic CSV files are in the repository-root `samples/` folder and inspect backend logs without exposing private data or secrets. `Shutting down` means the process received a stop signal; a normal shutdown log is not itself a crash, and a request returning 404 does not cause shutdown. I check whether Ctrl+C, the terminal, a task runner, or the hosting platform stopped it.
- I treat the current product limitations as unresolved: production authentication, rate limiting, and a full security review are unfinished; persistent dataset storage, durable dashboards, and a shared session database are absent. Local natural-language planning may misinterpret ambiguous metrics or follow-ups, AI explanations can be inaccurate even when computation succeeds, and conversation context is bounded and basic rather than comprehensive conversational memory.
- The latest self-contained UI offers bar and line charts and tables; other requested chart types are not implemented there. Insights are mainly descriptive statistics and general review recommendations, not a complete business intelligence engine. SQL and anomaly results are capped, and frontend tables show only the first `100` matching returned records. The displayed Pandas workflow uses SQLite via Pandas to preserve executed-query semantics and is not always a native `groupby` expression.
- No verified PDF export, deployment URL, screenshot collection, demo video, or comprehensive automated test suite is included. I keep API keys and `.env` files out of recordings and add real screenshots and a video link only after recording the running application.
- I use HTTPS and secure cookies in production. For local HTTP session problems, I set `COOKIE_SECURE=false`; I use `true` only for HTTPS deployment. Session isolation is not authenticated user access control.
- The current app has no login system, account authorization, or comprehensive request rate limiting. Anyone who can reach the analysis endpoint may consume provider credits. Before public use, I need access control and rate limiting, dependency-vulnerability review, and resource-exhaustion testing.
- The SQL path uses a controlled in-memory database, read-only authorization, and a query deadline, but it is not a complete operating-system resource sandbox. The backend does not execute arbitrary model-generated Python with `eval` or unrestricted `exec`.
- When AI is enabled, schema, questions, selected conversation context, and computed result values can be sent to OpenRouter and its model provider; I review their terms before uploading sensitive data. Uploaded datasets remain in process memory during a session, not encrypted durable storage, and their handling does not guarantee secure deletion.
- The proposed single Render instance uses `--workers 1`. If I deploy multiple workers or instances, I need shared storage and a defined data-retention policy because state is currently in memory.
- Docker configuration was discussed separately and is not verified as part of the working project. I do not assume `docker compose up` is available unless Dockerfiles and Compose configuration have actually been added and tested.

I built DataPilot AI as a local-development CSV analytics app with a React, TypeScript, and Vite frontend and a Python, FastAPI, and Uvicorn backend. It accepts one or more UTF-8 CSV files and lets me switch datasets within the current browser session. I can inspect previews, inferred types, missing cells, duplicates, and profiling warnings; ask supported analytical questions; run read-only SQLite queries; join datasets; detect numeric anomalies with IQR, Z-score, or Isolation Forest; and export results as CSV, Markdown reports, or text code.

When I try DataPilot AI, I can click **Explore sample data** or upload a CSV. The sample button requires both files in the repository’s `samples/` directory. The sample sales records are synthetic demonstration data, not real business results; they include dates, customer identifiers, regions, products, quantities, revenue, and marketing spend, with a few unusually large orders deliberately added to demonstrate anomaly detection. In **Data Sources**, I can review the first 100 records, inferred column types, missing cells, duplicates, and warnings about formatting or invalid dates. Profiling does not necessarily correct my source data: numeric formatting may be normalized in the analytical copy, and warnings explain relevant changes or limitations.

For natural-language analysis, I select the sales dataset and open **AI Analyst**. Example questions include comparing revenue by region, viewing monthly sales trends, finding the top five customers, and calculating average revenue. I inspect the result, chart, SQL, and warnings; the local planner is rule-based and can misinterpret ambiguous questions, while OpenRouter planning is limited to operations supported by the backend. In **SQL Playground**, the active dataset is SQLite table `data`; queries are read-only and results are capped at 500 rows. I can use this example aggregation:

```
SELECT region, SUM(revenue) AS total_revenue
FROM data
GROUP BY region
ORDER BY total_revenue DESC;
```


For anomaly detection, I choose numeric columns and a method. IQR uses bounds based on 1.5 times the interquartile range; Z-score uses bounds based on three standard deviations; Isolation Forest is multivariate and requires suitable numeric data and at least 10 records. I treat an outlier as a statistical signal, not proof of fraud, error, or a business problem, and review the evidence alongside its original context. To join datasets in **Data Sources**, I select the second dataset, left and right keys, and join type; for the synthetic files, I use `customer_id` on both sides. The backend checks key types and estimated join size. Pandas merge semantics apply, including possible matches between null keys, and overlapping columns receive suffixes.

I can save an analysis to the dashboard for the active session, but that is not permanent storage. Datasets and history live in backend memory, not a durable database; each browser session has a cookie identifying its workspace, and sessions expire after a configured idle lifetime. Backend restarts, deployments, or process reloads erase session data. Each session is limited to 10 datasets; CSV ingestion is limited to 100 columns plus configured row and file size caps, and previews do not display every uploaded record. Until shared session storage is implemented, I use one backend worker and one instance. Frontend navigation uses local React state, with no URL-based page routing in the latest frontend. I export results or code as CSV, Markdown, SQL, or Pandas code when I need a lasting copy.

| Method | Endpoint | Purpose |
|---|---|---|
| GET | `/api/health` | Service status and nonsecret configuration |
| GET | `/api/datasets` | List session datasets |
| POST | `/api/datasets/upload` | Upload CSV files using multipart form data |
| POST | `/api/datasets/sample` | Load synthetic sample datasets |
| GET | `/api/datasets/{id}` | Dataset metadata |
| GET | `/api/datasets/{id}/preview` | Preview rows |
| GET | `/api/datasets/{id}/profile` | Data quality and schema profile |
| DELETE | `/api/datasets/{id}` | Remove a dataset from the session |
| POST | `/api/datasets/merge` | Join two session datasets |
| POST | `/api/analysis/query` | Analyze a natural-language question |
| POST | `/api/analysis/chart` | Execute an explicit analytical plan |
| POST | `/api/analysis/insights` | Statistical facts and review suggestions |
| POST | `/api/analysis/anomalies` | Detect numeric outliers |
| POST | `/api/analysis/sql` | Run read-only SQL |
| GET | `/api/sessions/current/history` | Current session history |
| GET | `/api/dashboards` | List saved analyses |
| POST | `/api/dashboards/{analysis_id}` | Save an analysis |
| POST | `/api/reports/export` | Download results or code |


I use `/docs` on the running backend for request schemas and interactive API documentation. Browser requests use the same origin through the frontend proxy; standalone API clients must preserve the session cookie across requests. For a frontend build check, I run `cd D:\projs\datapilot\frontend` and `npm run build`; this checks TypeScript and creates a production bundle, but is not an end-to-end test. Before public deployment, I review dependencies with `npm audit`, resolve findings, and rerun build and workflow checks. I do not run `npm audit fix --force` blindly because it can introduce breaking changes.

- My manual smoke-test checklist covers: backend health; frontend loading without console or build errors; loading sample data and a user CSV; matching preview counts to input; checking a known aggregation against separate SQL; consistency between charts and tables; useful errors for invalid CSV; successful read-only SQL and rejection of destructive SQL; anomaly evidence and method labels; compatible joins; saved analyses and exports; isolation between private-browser sessions; and AI analysis with a valid key and clearly surfaced failures. Automated backend/frontend coverage has not been completed or verified. The presence of Pytest or other test dependencies does not establish that a test suite passes.

I keep calculations deterministic: when configured, OpenRouter helps plan supported queries and explain computed results, but it does not execute or replace the analytical calculations. Core profiling, querying, and anomaly tools work without an API key; if the provider fails, supported questions may fall back to a local planner with a warning. I review results, assumptions, warnings, and generated SQL before relying on an answer for a business decision, because natural-language support and the analytical engine remain limited.

For local development I use Python 3.11 or newer and Node.js 22 LTS with npm. The backend reads settings from environment variables; its documented defaults include a 20 MB per-file upload limit, a 100,000-row limit, and a 7,200-second idle session lifetime. The example OpenRouter model is `google/gemini-3-flash-preview`, but I check provider availability and change it if needed; if `OPENROUTER_MODEL` is unset, the code defaults to `openai/gpt-4o-mini`.

I keep `backend/.env` private and never commit it; `.env.example` contains placeholders only. I leave `OPENROUTER_API_KEY` empty when running without AI rather than entering a fake placeholder. For local HTTP I set `COOKIE_SECURE=false`; deployed HTTPS requires `COOKIE_SECURE=true`. The frontend calls same-origin `/api` routes through a Vite development proxy or production proxy. Backend sessions and datasets are held in memory, so enabling Uvicorn `--reload` restarts the process and erases them.

My local guide starts Uvicorn on port 8000 and Vite at `http://localhost:5173/`; the Vite proxy forwards `/api` requests to the backend. The latest self-contained `App.tsx` includes its own API helpers and components, so it does not need the optional older `api.ts` or `components.tsx` files. The frontend has been reported working, but I have not completed a full automated test suite, production security review, or end-to-end deployment verification. A 404 at the backend root is expected because it has no homepage route; a favicon 404 is harmless.

- AI-Powered-Fake-News-Detection, an NLP system that classifies news articles as Real or Fake using text preprocessing, Bag-of-Words and TF-IDF features, and KNN, Logistic Regression, Random Forest, and MLP Neural Network models. Its evaluation description lists Accuracy, Precision, Recall, F1-Score, and the truncated label “Confusion Matr.” It is Python; last updated 2026-09.
- EduAI, an AI-powered adaptive learning app built with Flutter and Dart using Android Studio. It offers personalized study plans, AI-based notes summarization, flashcards and quizzes via REST APIs, a Pomodoro timer, performance analytics, and offline storage. It is listed as Dart, 1 star, last updated 2026-04.
- bill-splitter-api, a shared-home bill-splitting service: create a home, add members, split bills so paise add up, and let each member pay their share. It uses integer-only money and is described as idempotent and race-safe, with 24 passing tests. Its stack is Hono on Cloudflare Workers + D1, React + Vite + TanStack Router, and TypeScript; last updated 2026-11.
- Aivoa-rca, an AI-assisted investigation tool for API manufacturing quality events. It extracts incident details from reports or messages, highlights evidence gaps, guides five-whys analysis, and drafts editable CAPA recommendations. Root causes remain unconfirmed until qualified personnel review them. It is JavaScript; last updated 2026-10.

I built AIVOA RCA as a local, full-stack prototype for investigating quality events in API manufacturing. Its Copilot-first workflow takes a deviation narrative or document, extracts details for me to review, generates an evidence-led five-whys/RCA draft, lets me edit proposed CAPA actions, and saves the investigation to a local ledger. I verify product, batch, event, containment, and impact details against the source, and review evidence gaps and unconfirmed hypotheses before saving.

I keep the tool within an investigation-support boundary: it distinguishes source observations from hypotheses, leaves root-cause suggestions unconfirmed until qualified personnel review them, and does not make batch-disposition decisions. I use synthetic data in demonstrations. This is a prototype, not validated for GxP use or a Part 11/Annex 11 system, and it does not replace approved site procedures or quality-unit review.

I need Node.js 18 or later and Python 3.10 or later. From the project root, I install and start the frontend with `npm install` and `npm run dev`; the local Vite URL is usually `http://localhost:5173`. On macOS or Linux, I create and activate a Python virtual environment, install `backend/requirements.txt`, then run Uvicorn; on Windows PowerShell I use `py -m venv .venv` and `\.venv\Scripts\Activate.ps1` instead. If I have not created `.env`, I omit `--env-file .env` from the Uvicorn command.

```
# Optional project-root .env settings
GROQ_API_KEY=your_key_here
GROQ_MODEL=llama-3.3-70b-versatile
DATABASE_URL=sqlite:///./backend/aivoa_rca.db
```


Groq is optional: with a key configured, the app can use model-backed extraction and analysis; without one, it still runs a local fallback workflow. SQLite is the default and its database file is created automatically. I can use PostgreSQL by setting `DATABASE_URL` to a SQLAlchemy PostgreSQL URL and installing `psycopg[binary]`. The backend supports PDF, DOCX, TXT, and EML; scanned PDFs need OCR first. Text input can use the frontend fallback when the API is unavailable, but document parsing and database persistence require the backend.

I can edit extracted fields by sending a clear Copilot instruction, such as `Change product to Amoxicillin 500 mg` or `Set batch number to AMX-240602`, then verifying the immediate form update; I can also edit fields directly. The API exposes `GET /api/health`, `POST /api/extract`, `POST /api/extract-file`, `POST /api/copilot`, `POST /api/rca`, `GET /api/investigations`, and `POST /api/investigations`. The README gives the backend port as 8000 and documents health and interactive API pages, but the host values in its commands and URLs are redacted.

The frontend keeps API client functions in `src/api/qualityApi.js`, UI components in `src/components/`, synthetic training and fallback data in `src/data/demoData.js`, local Copilot field-edit parsing in `src/utils/fieldEdits.js`, workflow orchestration in `src/App.jsx`, state in `src/store.js`, and styling in `src/style.css`. The backend's `backend/main.py` contains FastAPI routes, the LangGraph workflow, and persistence; dependencies are listed in `backend/requirements.txt`.

Before any production use, I would need appropriate authentication and authorization, validated audit trails, data-protection controls, model governance, testing, and system validation. The captured README does not specify test coverage, deployment, supported database versions, operational limits, detailed extraction fields, evidence-gap criteria, RCA logic, or CAPA-generation rules.

My AIVOA RCA workflow is adapted from the supplied AIVOA Copilot demo’s Customer Complaint interaction pattern: a focused investigation form on the left and a persistent copilot on the right. It is for pharmaceutical API deviation and root-cause investigation work; it does not implement the complaint module. I can start at Log Root Cause Investigation, provide an incident narrative or source document, review and edit the extracted intake fields against the source, generate a five-whys and CAPA draft, then save the draft or commit it to the local QMS ledger.

The intake covers product, batch, department, event summary, containment, impact, evidence, and missing evidence. After extraction, I review the hypothesis-only warning, undetermined cause, evidence checklist, five whys, and recommended actions; I can edit the investigation and action owners and dates before saving. The workflow distinguishes source-backed observations from hypotheses, surfaces absent records, and avoids automatic batch disposition, unsupported invalidation of OOS results, and “testing into compliance.”

- My documented API routes are `POST /api/extract`, `POST /api/extract-file`, `POST /api/rca`, and `POST /api/investigations`, plus `GET /api/health` and `GET /api/investigations`. The local backend uses port `8000`; API documentation is at `http://localhost:8000/docs`. The README’s `<redacted>` host values are unspecified.

For a local run, I install frontend dependencies with `npm install` and start Vite with `npm run dev`. In a second terminal from the project root, I create and activate a Python virtual environment, install `backend/requirements.txt`, and run Uvicorn on port `8000`. Vite proxies `/api` to the backend. The frontend has a deterministic safe fallback for pasted text when the API is unavailable, but file upload and persistence require the backend.

My documented regulatory references are the FDA’s *Investigating Out-of-Specification (OOS) Test Results for Pharmaceutical Production*, Revision 1 (May 2022), 21 CFR § 211.192, ICH Q7, and ICH Q10. Their applicability must be checked against current site procedures and jurisdiction. This prototype is not validated for GxP use, is not a Part 11/Annex 11 system or electronic-signature service, and does not replace approved SOPs, quality-unit review, or regulatory advice. I should not use real regulated or personal data in the demo.

Before production use, I would need to implement and validate identity and authorization, immutable audit trails, applicable electronic-record and signature controls, retention, document security, privacy and data integrity, model governance, monitoring, backup and recovery, and complete system validation. The README lists these as requirements; it does not establish that they are implemented. Scanned PDFs require OCR before upload, and the README specifies no OCR implementation or procedure.

---
From Siddhant Pradhan's second brain at agentsocialx.com/siddhantpradhan