I build production web systems with AI in the loop — and the test suites, release gates and live domains to prove they work.

Problem

My web studio needed more than a brochure: enquiries had to become a tracked pipeline I can act on, without paying monthly for someone else's CRM.

Approach

A one-page sales surface backed by a real back office. PostgreSQL via Prisma holds leads, notes, settings and an audit log. The public enquiry endpoint is a hardened pipeline — same-origin check, Turnstile siteverify, honeypot plus a 2.5-second time-trap, sliding-window rate limit and a payload cap. Admin auth uses scrypt hashing and HMAC-hashed session tokens, with login throttling.

My contribution

Everything: positioning and copy, the design system, the Prisma schema and five additive migrations, all API routes, the admin UI (leads CRM, package and availability managers, demo manager with secure image uploads), unit tests, the Netlify deployment and the custom-domain migration.

How AI was used

Built across agent sessions logged in a 54-entry worklog: each task starts with constraints up front — a frozen design system and a file-ownership table in AGENTS.md — then the agent implements, and I review diffs, run lint, typecheck and the unit suite, and probe live endpoints before any release. A scheduled reviewer agent audited my own passes.

Technical decisions

1. 01

   Demo cover images are stored in Postgres with magic-byte MIME sniffing and a monotonic version counter — one moving part fewer than object storage, and immutable cache URLs that a deletion can never resurrect.

2. 02

   Fail-open vs fail-closed is explicit: the public demo gallery survives a database outage; purchase-critical availability does not lie.

3. 03

   Netlify with a custom domain — including a documented workaround for the OpenNext adapter shadowing netlify.toml redirects.

Debugging

Named fix passes are in the history: a package-select overflow on mobile, a Bing meta-description issue, and the redirect-precedence bug that required reading adapter behavior rather than guessing.

Testing

Twelve unit suites (~150 cases) cover the Turnstile fail-closed matrix, CSV formula-injection safety, admin auth and demo cover handling. The release gate records lint/typecheck/build PASS, 39/39 tests and a live 401/403 probe matrix before deploy.

Result

Live since September 2026 at gerbangstudio.com.my. Enquiries land in the CRM with Telegram notifications, and the lead engine is documented for reuse in client deliverables.

Problem

Interns and field technicians in Malaysia write messy site notes and need professional documents, not another blank template. The catch: LLMs invent details, and an invented work record is worthless — or worse.

Approach

A two-stage pipeline. Stage 1 extracts raw notes into a strict JSON schema — activities, materials, equipment, results, and an explicit unknowns list. Stage 2 writes the report from those facts only, and the anti-invention rules live inside the schema's field descriptions, so the constraint travels with every request. React SPA talks to a Cloudflare Worker; the Worker verifies Firebase tokens against Google's JWKS server-side and calls Google Apps Script (shared-secret auth) to persist to Sheets and Drive with per-user owner_id isolation.

My contribution

The product spec and its hallucination contract, both AI stages and the provider factory (Groq gpt-oss-120b with Gemini as a drop-in fallback), the Worker API, the Sheets schema with in-place migration and LockService, a client-side image optimizer, and the whole validation suite.

How AI was used

Design came from 38 generated screen mockups that were then frozen in a design handoff doc — AI explored, I chose and locked. Feature work followed numbered suites: each capability (auth isolation, autosave, photo security, history scale) shipped with its own deterministic test script before being called done.

Technical decisions

1. 01

   Groq behind a provider factory — a second model is a config change, not a rewrite; a live smoke test asserts zero Gemini calls on the primary path.

2. 02

   Google Sheets as the database: RM0 cost, auditable by non-engineers, with additive migrations, document locks and caching — an honest trade for an MVP.

3. 03

   Photos are optimized client-side (1600px cap, quality 0.85) before they ever reach Drive.

Debugging

Auth isolation and photo security each have dedicated suites — a mocked multi-user store proves one account can never read another's records, and the real image optimizer runs against a mock Drive backend. A latency benchmark measures the live Sheets backend's list operations at scale.

Testing

Seventeen test scripts in three tiers: deterministic suites with dependency-injected mocks, live HTTP tests against wrangler dev, and live external validation (real Groq semantic checks, real latency benchmarking). Report-schema tests assert ACCEPT/REJECT on hallucination boundary cases.

Result

A complete, validated MVP that drafts real reports locally. Cloudflare deployment is the next step — the worker is already configured for wrangler deploy.

Problem

Access-control work — barrier gates, turnstiles, card readers, CCTV — needs a way to rehearse operations before touching real hardware, and software that can never claim a physical action succeeded when it didn't.

Approach

A simulation-first monorepo: a Next.js dashboard, a Fastify gateway, and four packages for shared domain logic, zod validation, device adapters and Prisma/MySQL persistence. Every command flows through capability checks, a simulation/physical branch, a pure six-condition safety gate, a PENDING record, adapter execution under timeout, adapter-confirmed result, audit and SSE broadcast. Every refusal is machine-readable and audited.

My contribution

All of it: the architecture, the vendor-neutral access rules engine with overnight time windows, the device state machines (barrier, turnstile, camera, NVR, reader), AES-256-GCM credential encryption, RBAC across four roles, the device simulator, and 94 test cases.

How AI was used

The project runs on a ten-rule AGENTS.md contract for agents — simulation first, no invented vendor APIs, physical actuation disabled by default, tests before success claims. Source comments cite spec sections; the agents worked from the spec, and I verified behavior against it.

Technical decisions

1. 01

   No vendor API is invented: undocumented adapters refuse every action except connection tests, and return a list of the official docs required to implement more.

2. 02

   Success is only reported after the adapter confirms it — the UI can never render a lie, and timeouts map to an explicit TIMEOUT state.

3. 03

   MemoryStore by default with Prisma as an opt-in — the entire platform runs with zero setup, and the store contract keeps both honest.

Debugging

The safety-gate refusal matrix, the audit-log secret-leak scan and the visitor auto-check-in flow each began as failures found by their own test suites — the suites exist because the behaviors mattered, not the other way round.

Testing

94 hermetic test cases across nine files — adapter state machines, the safety gate matrix, RBAC, audit sanitization, visitor lifecycle — all via Fastify app.inject with no hardware or database required.

Result

A complete v0.1 platform in daily local use — runtime logs show sessions across all 18 dashboard pages. Real hardware adapters are the documented next step, gated behind the same safety rules.