We'd like to use Google Analytics to see which pages people actually read. It sets cookies. Everything we need to run the site works without it.

Work

Real builds.
Ugly parts included.

Four, spanning the range on purpose — a product, an agent, an integration, a rescue. Depth beats breadth.

AI agent

7 weeks

A WhatsApp agent that survives real volume

A support bot for a regional retailer that had already burned one build on prompt-only logic. We replaced it with grounded retrieval, an eval harness and a human handoff path for anything the model shouldn't touch.

The ugly part: The eval harness took longer than the agent itself — and is the only reason it didn't regress silently after the third prompt change.

WhatsAppagentgroundedretrieval storehuman handoffeval harness
How it fits together — the part in red is the part that hurt.
Integration

4 weeks

Order sync between a storefront and a CRM that disagreed on "cancelled"

Two systems that were supposed to be one workflow. Orders were duplicating on retries and refunds weren't reconciling.

The ugly part: Idempotency keys were missing on both ends. Fixing it meant a migration pass over three months of historical orders before the sync could go live.

storefrontCRMorderretried — written twice"cancelled"≠ "cancelled"
How it fits together — the part in red is the part that hurt.
Product build

9 weeks

An internal claims tool for a small insurer

Three roles, a real approval workflow, and an audit trail required by a regulator who does actually read the logs.

The ugly part: The permission model was the real product. The screens were the easy 20%.

adjusterapproverauditorapprovalper roleauditevery write
How it fits together — the part in red is the part that hurt.
Prototype rescue

3 weeks

A Bolt-built booking app with no auth

Worked perfectly in the demo. In production it had no rate limiting, no error states, and an admin route anyone could hit unauthenticated.

The ugly part: The database had been publicly readable for six weeks before anyone noticed. We rotated every credential on day one.

visitorappno auth/admindatabasepublicly readable
How it fits together — the part in red is the part that hurt.

Yours is next

Tell us what you're building.
We'll tell you what it takes.

A few questions, then effort in weeks — and the ugly parts named up front, the way they are on this page.

Start scoping yours