Things I’ve Built.
And How the Method Applies.

A governed software lifecycle for code written with AI. Every stage — scoping through review to release — ran through a named phase with its own entry and exit criteria, so a change could always be located at a known point in the lifecycle rather than treated as an ungoverned edit. Its own marketing and documentation copy was linted for overclaiming against a maintained denylist, failing the build on a hit; anything the lint could not adjudicate routed to a named human reviewer before it could ship. A DPIA was carried out and kept current for as long as it processed personal data.

Six parallel research workstreams — demand, competition, operations, costing, financials and risk — run to completion before any product code was written. The build itself carries a margin-protection pricing engine whose cost and margin fields must never reach the browser, and that boundary is enforced by a compile-time assertion rather than a runtime filter or a code-review checklist: pass a cost-bearing data shape toward client-facing code and the build fails before it ships. On top of that boundary, a live 3D product configurator and server-generated quote and RFQ documents.

A Node dashboard that tails a coding agent’s own session transcripts through a filesystem watch, including per-subagent transcript files, and serves a live view: current status, the tool in use right now, token spend, elapsed time, session cost and context-window usage. Zero npm dependencies — the whole thing runs with node server.js. Built in a single day.

A cross-project status registry and collector tracking every project run through the toolchain, feeding a dashboard on a scheduled local collection cycle. It answers the question every multi-project operator eventually asks: what is actually running, and where. The registry was built first, then sized as a product — and the architecture, competitive and market-viability research that followed reached a plain verdict that the addressable market was too small to justify productising it. It stayed an internal tool.

A bash-first monitoring service on the classical Golden Signals method: external heartbeat, disk usage, memory usage and container count, each on its own schedule. It ships with its own installer script and a macOS LaunchAgent definition, so it runs continuously as a background service instead of relying on someone remembering to check it. Small, tested, and boring on purpose — which is the point of the method.

Built to solve a one-off naming problem for a real venture, then generalised. A brief goes in; genre-diverse candidates come out; each is checked against authoritative domain-registry clearance data rather than a guess or a cached list; results fan out across a registry proxy; and a fixed scoring rubric ranks the shortlist that emerges. The naming problem belonged to one venture. The pipeline that solved it did not.

Live since August 2026. A password-gated web portal front-office staff use to raise tax-compliant invoices, quotations and payment receipts against the live member ledger. Two pricing modes: rate-driven, where tax is added on top, and agreed-total, where the taxable amount has to be worked back out of a fixed inclusive figure — which is not cleanly invertible under statutory rounding, so the generator searches for the taxable base that reproduces the target total exactly. Multi-line documents allocate the subtotal proportionally with the last line absorbing the rounding remainder, so line amounts always sum to the total. Quotations prorate a partial first month against a date range rather than rounding to whole months.

The portal writes into a spreadsheet three people already had open, which has no transactional isolation of its own. Every write takes a document lock with a timeout, so two staff cannot race the same receipt number. The password exists only as a hash in a script property — not in source, not in docs, not in version control — and is compared with a hand-rolled constant-time check, because the runtime has no native one. It went live against a written checklist: backup taken and read back before promotion, every document type test-generated and visually inspected as a finished page, and a confirmed zero dummy records in production.

Set up and running for the same operation, currently supported under supervision. It reads the operational group and turns a day of chat into a twice-daily brief — what was decided, who owns it, what is still open — with every item linked back to the message it came from. It is structurally prevented from inventing one. Model output is rejected unless every field matches an allow-listed key set, every cited message is one actually supplied to it, and any assignment of an owner is traceable to text that really named that person. It returns unknown rather than guess. Reviewers rate each decision as correct, incomplete, wrong or unsafe, and approved corrections create a new immutable version of that knowledge rather than overwriting the old one — so it improves through a reviewed loop with an audit trail, not by drifting.

The assistant talks to a real business group, so a wrong or duplicate message is a real-world error rather than a log line. Its decisions are written to a review queue; actual delivery runs through a separate gated path that checks a mute switch first, so nothing the model produces can send itself. Every hop is treated as at-least-once, with unique idempotency keys on both model invocations and outbound messages — a redelivered job replays the stored result instead of calling the model and billing twice. Ambiguous outcomes become a state a human reconciles, never an automatic resend. Failures dead-letter into an audited path rather than disappearing. And retention is enforced by a scheduled purge that nulls content and strips actor identifiers on a clock, leaving a tombstone recording that something was removed without retaining what.

It runs on an edge platform — serverless workers, a strongly-consistent coordination object used as the deduplication gate, a managed queue with a dead-letter path, SQLite at the edge. It also runs as a self-hosted build on a plain VPS: the same domain model on PostgreSQL behind a reverse proxy with automatic TLS, in containers that are read-only with all capabilities dropped. Without a managed queue, that build claims work with row-level locking that skips locked rows, and serialises the daily model-spend check behind an advisory lock so two workers cannot both pass a stale count and overshoot the cap. Portability was the point: the same product, not tied to one vendor.

Business mail from a live domain was landing in spam for some recipients and arriving cleanly for others — the pattern that makes a mail problem hard to pin down. The cause was an SPF record making twelve DNS lookups against RFC 7208’s hard limit of ten, producing a permanent error that strict validators read as no authentication at all, while lenient ones short-circuited on the first match and let the mail through. Fixing it meant first establishing that DNS was not actually being served where the registrar’s own control panel implied it was. The rebuilt record sits at seven lookups of ten, with headroom left deliberately.