AL

EMADIAN

A static data layer on a CDN, a runtime API behind corporate SSO, maps in MapLibre, charts and 3D where they earn their place. Under the plain-English search sits a model with tool access across all six sources, so one answer can pull from each and cite where every number came from.

Built modular, so a second country was a configuration change, not a rebuild. One person designed it, built it, and owns it, down to the security tickets. It is the daily driver for the business, not a tool that gets opened once and forgotten.

Design callI chose one consistent auth model over hardening a single route. Security that only covers one door is not security.

Five serverless functions feed a queue. A worker on an always-on box runs the coding agent headless to branch the repo and write the fix. Five gates run before anything ships: type-checking, linting, a browser test diff across the routes, a model critique with a quality floor, and an idempotency precheck.

The final deploy runs from a laptop daemon, because the release certificates are gated behind corporate SSO and cannot live in the cloud. It runs on the surface that already holds them. Every run is watched by 11 alarms. The trust boundaries live in code, where the model cannot talk its way past them. Scope is deliberately bounded to a known class of fixes today, and widens as trust in the gauntlet grows.

The hardest decisionThe classifier once carried a trusted-override instruction in its prompt. The model refused it, reading the override as a possible injection. It was right to. I moved the contract into deterministic code, so it holds whether the model cooperates or not. Fix the contract, do not fight the model.

A five-stage pipeline runs across 22 Lambda functions for every contact: research across six sources, analysis of every prior thread, generation in my voice with extended thinking, 15 compliance checks, and delivery to a Slack card. Three models, eight databases, about $50 a month.

The compliance stage is the point. CASL consent, colleague dedup so two reps never hit the same contact, brand rules, and a hallucination scan that kills any claim it cannot trace to a source. The system drafts and cites. I read every word and send. That boundary lives in code, where a prompt cannot loosen it.

The hardest decisionI built it to send on its own, then took that away. A system that emails people unsupervised is a liability, not a feature. The value was never the sending. It was the research no human has time to do, every time.

An always-on box runs eight systemd timers through the night. Four agents work in sequence, each on extended thinking with no cheaper model in the chain: researcher, briefer, adversarial critic, handoff. They reach across the data with 18 tools. The whole run finishes in about 24 minutes.

The adversarial critic is what makes the brief trustworthy. It exists only to disagree, to find the reason each lead is not really a lead. What clears it reaches me with the challenge it survived. 1,508 tests keep the chain honest, because an autonomous system I do not watch overnight has to be one I can trust by morning. It only ever qualifies and hands off, and never contacts anyone itself.

The hardest decisionI gave it the power to score leads and almost stopped there. Then I built an agent whose only job is to disagree with the others. The score was never the hard part. Earning the right to act on a score I did not personally check was. The critic is how I sleep through the run.

Each memory is a markdown file with YAML frontmatter, linked to others with a wiki-style graph syntax, and a curated index loads at startup. Recall runs four stages: embed the question, then fuse a vector and a keyword search with reciprocal-rank fusion. A cross-encoder reranks the top results, and an MMR pass diversifies them, so the five memories that reach the answer are relevant without repeating each other.

Every answer is grounded. It can only draw on what was retrieved, and each line carries the memory it came from, so there is a file behind every claim. The store is one SQLite database in write-ahead mode, cosine similarity computed in numpy, about 1,170 lines with no framework underneath. It is deliberately boring: plain files I can read and edit by hand, no database I cannot open, no service I cannot restart.

The dream pass runs nightly, and it is purely additive. It groups the day's new memories by what they are about, then writes a short three-sentence summary for each group into a separate consolidated folder, so recall gets a high-level entry point next to the detail. It never rewrites or removes the source files. A separate check can flag likely duplicates, but only to surface them for me to review. Nothing is merged automatically.

The hardest decisionThe easy version stuffs everything into the context window and lets the model sort it out. That gets slower and more expensive as the history grows, and the answers get worse, not better. So I put the work into retrieval, and into the nightly pass that keeps the store legible. I built this before there was an official memory primitive to reach for. The shape it took has held up since.

It sits inside the Operations Center as one of a family of internal tools. The directory and the reporting lines load as a static graph on a CDN, so the whole org is in memory and search returns instantly. A ranking pass scores every person against the query, by role, by team, and by how close they sit to what I asked about.

The graph is a force-directed layout of the entire company. Selecting a person walks the reporting edges to trace their chain up to a leader and pulls in their direct team, so one click turns a flat list into a map. Every node is a real directory record, nothing scraped, nothing guessed.

Design callA search box over an employee table would have been a weekend. The graph took the real work, because the answer I needed was never just a name. It was the structure around it: who they report to, who reports to them, where they sit. That is the difference between a directory and a map.

The operator surface is Slack, not a bespoke UI. A mention spawns a real agent session on an always-on box, streams the work back into the thread, and persists the session so a follow-up resumes it. One run holds per thread, the rest queue, and three separate paths can kill a run. Underneath sit 51 typed tool interfaces into the CRM, the mailbox, memory, and Slack, and a 1024-dim vector store the agents search for past context.

Reasoning agents run on the always-on box, where cloud auth never expires. The actions that need a corporate sign-in run on my managed laptop, which the cloud cannot reach, so control is inverted: the box drops a task in an object-store queue and the laptop polls it every 30 seconds. Every agent runs on the top model at full effort, with no cheaper tier anywhere. Because the gateway can quietly serve a smaller model, a detector reads the model id off each response and raises an alarm when what was served does not match what was asked.

Over all of it sits one supervisor: a single brain that wraps every producer behind one execute() interface, so the whole fleet runs as one orchestrated system instead of a set of independent scripts. It was built test-first and hardened through three adversarial review rounds, with a kill switch on the whole thing. All of it carries 1,508 tests behind 352 single-author commits.

The hardest decisionThe headless paths have to run with every permission prompt bypassed, or they hang with no one to click allow. But a message to a customer can never go out without my say-so. Those two look like they contradict. They stop the moment approval is not a prompt at all. I made it a state in a queue that only I can flip, with the send tools blocked at the harness on top. Bypassing prompts cannot bypass a gate that was never a prompt.

The hard part of a site like this isn't the look, it's making heavy motion feel weightless. The main dashboard is pinned to the scroll as a fixed layer driven by a single ScrollTrigger, so it can switch from an audit view to a live one without dropping a frame. Smooth scrolling runs on Lenis, the reveals and pins on GSAP, and the headline that plays video inside the letters is its own component.

Behind the cost calculator is a real back end, not a third-party form. It recomputes every figure server-side so the emailed snapshot always matches what's on screen, then sends a branded copy to the visitor and a lead notice to me, with an origin check, a honeypot, length caps, and a rate limit in front of it. The whole site builds to a static export and ships file by file.

Design callThe dashboard shows the cost before it shows the fix. Nobody feels a solution until they've seen the problem counted up in their own terms. So the audit comes first, red and specific, and the running version second. The order is the argument.