Napaporn
Suttinarksombat

Senior Software Engineer

Tungthanasin Co., Ltd. (Easy Money)

• POS platform — technical owner and principal developer: the custom-MVC PHP point-of-sale and inventory system behind a 90+ branch retail network — the person every POS change and incident routes back to, and the author of most of its code.
• Oracle ERP integration — the outbound half is mine: the AR Invoice / AR Cash Receipt / Credit Note push out of the POS, dispatched through one named-operation layer that resolves the correct ERP organization per branch, with unknown operation names and malformed payloads failing loudly to an alerting channel rather than silently. The inbound importer that reconciles ERP lot data back into branch stock was written by a colleague: I integrated against its contract and had to understand its two-dimensional mapping over lot status and warehouse locator and its overlap-window pull, but I did not write it and will not claim it.
• Financial correctness (MSSQL): single-transaction repricing that also updates carts already holding the item, so nobody checks out at a stale price; daily branch revenue aggregation made idempotent by rolling back an order’s prior contribution before re-accumulating, using exact-decimal addition instead of float math.
• Thai full tax invoice (ใบกำกับภาษี): a dedicated renderer covering head-office versus branch designation and separate per-company VAT / non-VAT layouts, plus credit-note reporting.
• Operations tooling: a centralized alert gateway that normalizes failures from several internal systems into severity-routed Microsoft Teams cards, and the point-of-sale side of the PDPA consent gate, which I share with a colleague rather than own.
• Partner sales-channel integration — API contract owner: designed the API surface a new sales channel used to transact against both the POS and the consumer gateway, wrote the module-level API specification, and built the service-to-service auth client (token acquire → cache → JWT-expiry decode → pre-emptive refresh). Introduced the channel as a first-class dimension across order routing, product publish state, payment-callback routing and employee purchase quotas. When the programme was cancelled I decommissioned it cleanly — the whole cross-cutting integration removed from both live systems with no downtime.
• Consumer API gateway (scoped): cart/checkout, catalog, customer, e-receipt and LINE LIFF modules inside a team-owned, no-framework PHP gateway serving the mobile app and e-commerce front ends.

Full Stack Developer

Premacare International Co., Ltd.

• The only engineer: architected the internal IT ecosystem end to end — requirements, stack selection, schema design, build and operation — replacing paper processes with digital systems.
• R&D formulation & regulatory system: built the in-house system that catalogues raw materials with their INCI composition and derives a finished product’s regulatory ingredient declaration, then rewrote it into a controlled-document engine producing ISO-style PDF and Excel dossiers in domestic, full and export-filing variants across three legal manufacturing entities — turning a hand-assembled dossier into a generated one.
• Public platform & CMS: built the multilingual marketing site on a database-driven SEO layer (per-page, per-language metadata, JSON-LD, generated sitemaps, Thai-language URL routing) behind a custom CMS — sustaining strong organic search rankings.
• Vue-based admin & ERP screens: built the internal screens as Vue 2 / Vuetify 2 applications mounted inside server-rendered PHP views — no bundler, no build artifact, deployed by copying a file — including permission-driven forms whose per-field editable state is derived from the server-computed capability set rather than trusted from the client.
• Manufacturing ERP: QC lab testing, stability studies, raw-material lifecycle and production planning modules inside the same platform, with authorization recomputed from the database on every request rather than trusted from the session.

Software Engineer

• Three production systems, one engineer: a legacy PHP platform, a Nuxt 4 operations tool, and the infrastructure both run on. In the PHP platform’s repository I am the only author in its entire history.
• Strangler-fig migration onto Nuxt 4: moving the operations tool one route at a time, in production, with nothing switched off. A route registry compiles to an nginx map that defaults to the legacy system and generates its own live E2E cases, so the routes that exist and the routes that are claimed cannot drift apart silently.
• Quality gates that block a deploy, not a checklist: lint at zero warnings, architecture and module-structure checks, file size, timezone (a bare toISOString() outside the shared helpers fails the build after it wrote UTC into 42 call sites on a Bangkok host), and a single icon set enforced after three families were found in use at once.
• The environment is mine too: a Docker development platform running two PHP versions side by side behind one reverse proxy with local SSL, and a deploy pipeline from git push through CI build to server pull with four fallback paths. The tunnel to the production database is profile-gated so it never starts on its own.

AI Engineering & Applied R&D

Personal projects

• Built Hermes, a self-hosted assistant (Bun + TypeScript): provider × model × key failover across six LLM providers with tiered per-key cooldown, reused as one primitive across several external API surfaces; free-tier enforcement that stays on unless explicitly disabled; two bounded agent loops (ReAct and native function-calling) with separate tool registries; an MCP stdio tool server; and a deny-by-default SQL gate in front of a production database — reads and tightly bounded writes only, destructive statements structurally unreachable.
• Delivered an AI CRM copilot (Next.js 14, Prisma / PostgreSQL): prompt-injection filtering, PII redaction before any model call, Zod-validated output degrading to a constant-output deterministic fallback, and every AI action written as a draft a human must approve. Shipped with a written eval spec, a Playwright E2E suite including adversarial RBAC cases, and HMAC-verified webhook ingestion with replay idempotency.
• Authored the agentic engineering standards my AI coding agents run under — strict typing, fail-closed authorization, audit-logged mutations, pre-ship security checklists — plus five committed agent-capability skills in the repository they govern, including one that refuses to deploy to production unless a human supplies an exact authorization token and that rejects being talked into it in plain language.