How I Build
/ How I build · 01
AI collapsed the cost of building. It raised the price of being wrong.
Every claim below points somewhere you can check it: a kill memo, a register, a file in this repo. verified 2026-08-07
/ The business side · 02
I own outcomes, not deliverables.
The studio makes money when a bet works, not when a sprint closes. That changes what gets built, what gets stopped, and how it is priced. These are the parts of that which are visible from outside.
/ 01
I write the stop criteria before I write the code.
Every venture enters with a named gate, a date, and a number that would end it. Willingness to pay, market access, risk, timing. If the gate fails, the venture stops and the memo goes public.
Instead of · A roadmap tells you what to build next. It has no opinion about when to stop, which is why most things that should have died are still being funded.
The kill archive →- Behavioral demand testing
- ICE / RICE
/ 02
I take ownership positions, not billable hours.
The portfolio is owned or co-owned, two of them with named partner entities that carry real obligations. Client Systems work is fixed scope against a defined operating outcome.
Instead of · An agency gets paid whether or not the thing works. That is not a character flaw, it is what the contract rewards. Ownership rewards something else.
/ 03
I price scope with a written end, and there is no retainer tail.
Fixed scope, a defined operating outcome, and a written condition that closes the engagement. The ladder from a written fit read to an install is published, including what each step costs.
Instead of · A retainer pays for presence. It quietly converts a supplier into a dependency, and the incentive to finish disappears on both sides.
The offer ladder →- Shape Up
/ 04
I publish what I killed, and the exact gate it failed.
Each archive entry carries the bet, the gate that failed, the date, and the memo. Not a post-mortem written for comfort, the criterion that was set in advance and then missed.
Instead of · Every studio publishes its wins, which is why wins carry almost no information. The archive is what makes the rest of the portfolio readable.
/ 05
The studio runs on the systems it sells.
This site, its content CMS, the ship log, the billing gateway, and the operator dashboard are the same layers a Client Systems install puts in. The implementation files are readable, not described.
Instead of · A reference implementation a buyer can open is a different category of evidence from a deck about one.
/ The growth side · 03
Distribution is the other half of the product.
Build is abundant now. Demand is not. Every venture and every install carries the machinery that gets it in front of someone, measured well enough to know whether it worked.
/ 01
I build loops, not funnels.
A loop has to clear five criteria before it gets budget: the output has to feed the input, the cycle has to be measurable, and it has to survive without new spend. Funnels stay, but as diagnosis rather than strategy.
Instead of · A funnel is a report on what already happened. A loop is an asset that produces the next cohort. They are priced identically and they are not the same thing.
Growth architecture →- Growth loops
- North Star + AARRR
/ 02
One channel is proven to payback before the next one opens.
Channel work runs single threaded until payback is visible by cohort, then it gets written into a playbook the client's own team runs. Only then does a second channel start.
Instead of · Running four channels at once produces activity in all four and attribution in none. Sequencing is slower for a quarter and faster for a year.
/ 03
Instrumentation goes in before budget does.
One North Star, a minimum instrumentation set, and cohort tracking exist before the first campaign runs. Attribution cleanup comes before attribution reporting.
Instead of · Spend that starts before measurement can never be evaluated afterwards, only defended. The number arrives too late to change the decision it was meant to inform.
North Star and instrumentation →- North Star + AARRR
/ 04
Positioning is the first growth lever, not the last.
The category, the spine, and the job the buyer is actually hiring for get written before a channel plan exists. The words on the page are treated as part of the system, not decoration on it.
Instead of · A weak position makes every channel more expensive at once, and no amount of spend corrects it. It is the cheapest thing to fix and the last thing most teams touch.
Jobs to be Done in model transfer →- Jobs-to-be-Done
- Working Backwards (PR/FAQ)
/ 05
Lifecycle is a system, not a campaign.
CRM scoring, routing, and lifecycle loops ship wired together, with the handover playbook as a deliverable rather than an afterthought.
Instead of · Campaigns end when the person who ran them leaves. A wired system keeps running, which is the entire difference between a marketing spend and a marketing asset.
/ Operating stack
Borrowed frameworks, my gates, and the tooling behind them.
What I actually run, and the defaults I install. Models are rented; harnesses and eval corpora are owned. Not every tool on every engagement.
Full hub: Operating stack memo →
Borrowed frameworks
Jobs-to-be-Done
RECONChristensen / Ulwick
Name the job a buyer hires a solution to do, the forces that block progress, and the outcomes that count as proof.
Exiid: Opportunity Engine, smoke offers, concierge specs
Receipt →Theory of Constraints
crossGoldratt
One bottleneck at a time: exploit before you elevate headcount or tooling.
Exiid: Brief Desk to first paid Diagnostic as the constraint
Receipt →Working Backwards (PR/FAQ)
RECONAmazon
Write the outcome and proof metric before scope expands.
Exiid: Model Transfer Evaluation artifacts
Receipt →Behavioral demand testing
RECONMom Test / Pretotyping lineage
Opinions are noise; costly actions are signal.
Exiid: Signal Ladder rungs 4 and 5
Receipt →Wardley Mapping
RECONSimon Wardley
Timing window and evolution of market components.
Exiid: Market Transfer criterion 5: timing window
Receipt →Shape Up
RAIDBasecamp
Fixed time, variable scope; appetite not estimate.
Exiid: 2 to 4 week Evaluation, 3 to 6 week validation sprints
Receipt →Kano Model
RAIDKano
Separate must-haves from delighters in MVP scope.
Exiid: Build stage artifact discipline
Receipt →North Star + AARRR
RAIDAmplitude / Pirate Metrics
One primary outcome metric; cohort instrumentation.
Exiid: Growth Architecture Minimum Instrumentation Set
Receipt →Growth loops
RAIDReforge-style doctrine
Loops compound; funnels diagnose.
Exiid: Loop Qualification Test (five criteria)
Receipt →ICE / RICE
RAIDSean Ellis / Intercom
Prioritize experiments when capital is scarce.
Exiid: Validation Engine kill lines
Receipt →Workflow-first automation
crossPattern
Automate steps, not an AI.
Exiid: Three lanes: deterministic, judgment-light, judgment-heavy
Receipt →Eval-driven promotion
crossML ops practice
Autonomy earned by evidence, revoked on suspicion.
Exiid: Autonomy Ladder L0 to L4, Approval Line
Receipt →OODA
crossBoyd
Fast observe, orient, decide, act cycles.
Exiid: Fast cycles, kill early operating norms
Receipt →DACI
crossIntuit
Who decides on Client Systems, Venture Partnership, and Advisory structures.
Exiid: Engagement track selection
Receipt →
Workflows
- 01
Brief Desk to fit review
RECON2 to 3 business days: next steps or direct no-go with reason.
- 02
Decode to Validate (RECON) or kill
crossRECON before RAID; weak evidence stops the work.
- 03
Signal Ladder gating
RECONNo build capital below rung 4 (commitment or payment).
- 04
Concierge to automation spec
RAIDManual delivery logs become Product and AI build input.
- 05
Autonomy promotion and demotion
crossEval evidence promotes; suspicion demotes instantly.
- 06
Eval loop
crossGolden set on change, runtime checks every run, weekly drift review.
- 07
Public kill archive
crossFailed gates published with written reasons.
Studio tools
- Receipt →
JTBD + outcome mapping
InstallRECONJob, forces, desired outcomes for smoke offers
Similarweb / Semrush
BenchRECONReference-model traffic and channel baselines
Paid signal for corridor scans
Crunchbase / PitchBook
BenchRECONFunding, M&A, category maturity
Figma
InstallRECONOffer flows, funnel maps, exceed-delta sketches
Notion
InstallRECONResearch memos, go/no-go packages, partner data rooms
Linear
InstallRECONIssue intake, sprint scope, kill decisions as closed issues
- Receipt →
GitHub
RunscrossSpecs, ADRs, public kill archive source
Agent surfaces we run
Model-agnostic where it helps. Gated everywhere it matters.
Cursor
Primary coding harness: multi-file edits, CI-gated merges
RunsClaude
Decode, drafts, go/no-go memos, reviewed automation
RunsCodex
Bench coding + failover when Anthropic unavailable
BenchGemini
Bench for long-context research and multimodal decode
BenchOpenCode
CLI agent surface for headless CI and scripted lanes
InstallOpenClaw
Heartbeat agents for always-on ops on client installs
InstallPi
Lightweight L1 assist for quick capture workflows
BenchHermes
High-reasoning strategy and CEO-class planning tasks
Bench
Also fluent across these runtimes
Build and install work is not locked to one agent runtime.
Logos identify tools we use or install; no endorsement implied.
Model routes
Models are rented. Route by task lane, not one model for everything.
| Task | Default | Autonomy |
|---|---|---|
| Decode / research | Claude SonnetBench: GPT-4o, Gemini Pro | L1 |
| Structured extraction | Claude Haiku / GPT-4o miniBench: Gemini Flash | L2 |
| Code generation | Claude Sonnet via Cursor | L2 |
| High-stakes draft | Claude SonnetBench: Opus for hard judgment | L2 |
| Irreversible / identity-bearing | Human only | L0 |
| Embeddings / RAG | text-embedding-3-large or voyage-3Bench: Cohere embed | L4 |
| Batch enrichment | Haiku / mini at volume | L3 |
Harnesses
Coding harness
RunsAgent edits + typecheck + lint + unit/E2E CI before merge
Gates: CI green · Playwright on conversion paths
Receipt →Eval harness
InstallGolden set on every prompt/model change; trace comparison
Gates: 50 golden cases minimum
Receipt →Orchestration harness
InstallDurable workflows, retries, human approval nodes
Gates: n8n · Temporal · Paperclip (bench)
Receipt →Promotion harness
InstallAutonomy Ladder gates: 200 @ 98% before L3; demotion on suspicion
Gates: 200 reviewed @ 98%
Receipt →
/ The build · 05
No human reviews my pull requests. Four agents do.
Four of them read every pull request before it can merge, and none of them can approve it. What actually blocks a merge is enforced by a server rather than by a habit, and the controls I have not switched on are listed too, with the reason.
This describes exiid-os, the repo behind this site. It is the same posture I install, not a claim about a system you already run.
Edit
On my machine, with the agents denied every env file and key.
Pull request
Direct pushes to main are refused by the server, not by habit.
Agent review
Four reviewers read the diff automatically. Advisory: none can block or approve.
Typecheck · tests
A type check, the full suite, and a build that runs with no secrets.
Size budget
485 KB gz of first-load JavaScript per route, or the build fails.
Branch protection
Required check, admins included, no force push, no deletion.
Production
Deploys on merge to main. Nothing reaches here another way.
There is no second path. Direct pushes to main are refused by GitHub, and that applies to the account that owns the repo.
/ Before anything ships · 06
What has to pass between an edit on my machine and a page you can load.
- Enforcedverified 2026-08-07
I cannot merge past my own check.
- Blocks ·
- Any change that fails type checking or tests, pushed from any account including mine.
- Detail
- Branch protection on main requires the check named Typecheck · tests, requires the branch to be current before it merges, and applies to admins. Force pushes and branch deletion are off. Conversation resolution is required.
- Branch protection · main · require status checks: Typecheck · tests
- .github/workflows/ci.yml
- Enforcedverified 2026-08-07
Every pull request runs a type check, the full test suite, and a production build.
- Blocks ·
- A type error, a failing test, or a build that only works on my machine.
- Detail
- 77 test files covering the shell, the content layer, the navigation invariants and the billing contract. The build step runs with no secrets at all, exactly as a fresh clone would, so a missing integration key can never be the reason a deploy works for me and not for anyone else.
- .github/workflows/ci.yml
- npm run typecheck && npm run test
- Enforcedverified 2026-08-07
The build fails if a page gets heavier.
- Blocks ·
- A dependency that quietly adds weight to the first load of a public route.
- Detail
- 485 KB gzipped of first-load JavaScript per route, measured against the real prerendered HTML and exiting non-zero on a breach. It runs at the end of every build and again as its own step in CI, so editing the build script cannot drop it. This page is one of the routes it measures.
- scripts/first-load-budget.mjs
- npm run check:budget
- Enforcedverified 2026-08-07
Two of those tests guard things no feature would think to check.
- Blocks ·
- An animation library creeping onto the eager path, and an em dash reaching customer-facing copy.
- Detail
- One asserts that GSAP never enters the shell's eager import graph and that every animated surface loads through a dynamic import. The other reads the content and app directories and fails the build on a single em dash, because the house voice bans them.
- src/lib/motion-budget.test.ts
- src/lib/content/punctuation.test.ts
- Enforcedverified 2026-08-07
CI leaves no usable credential behind on the runner.
- Blocks ·
- A compromised action or dependency reading a token out of the build environment.
- Detail
- The workflow grants contents: read and nothing else, and checkout runs with persist-credentials false so the git remote carries no token after the job.
- .github/workflows/ci.yml
- Enforcedverified 2026-08-07
Every change goes through a pull request. Over 120 so far.
- Blocks ·
- An untracked change to production with no diff, no checks, and no record.
- Detail
- The template carries a no secrets or keys committed checkbox and a rollback line. Direct pushes to main are refused by the server, not by discipline.
- .github/PULL_REQUEST_TEMPLATE.md
- Branch protection · main · include administrators
- Partialverified 2026-08-07
Four agent reviewers are wired to every pull request.
- Blocks ·
- A bug or an unsafe pattern that the type checker and the tests both allow through.
- Detail
- Cursor Bugbot for defects, a Cursor security reviewer, a Cursor approval agent that routes the request, and Blacksmith's code reviewer. They run automatically on open and on every push, not on request.
- Limit ·
- They are advisory, not required. None of them is a required status check, so a merge does not wait on them, and their coverage is uneven in practice: on the pull request that shipped this page, two completed, the security reviewer returned neutral, and Bugbot reported its own run as failed. An advisory reviewer that silently does not run is worth less than the badge suggests, which is why this is partial rather than enforced.
- Checks on every PR · Cursor Bugbot, Cursor Security Reviewer, Cursor Approval Agent, [code]smith
$ npm run test
Test Files 76 passed (76)
Tests 601 passed (601)
Duration 2.04s$ npm run check:budget
First-load JS budget · 485 KB gz per route
✓ / 437.9 KB gz (20 chunks)
✓ /about 439.7 KB gz (20 chunks)
✓ /systems 442.4 KB gz (21 chunks)
✓ /method 438.7 KB gz (20 chunks)
✓ /partner 432.3 KB gz (19 chunks)
✓ /contact 445.8 KB gz (21 chunks)
✓ /how-i-build 437.0 KB gz (20 chunks)
✓ 7 routes within budget · worst /contact 445.8 KB gz/ Keys and access · 07
How credentials are stored, and what the agents I run are allowed to touch.
- Enforcedverified 2026-08-07
A key never reaches a shell history, a log, or a chat window.
- Blocks ·
- The most common way a credential leaks, which is a human pasting it somewhere convenient.
- Detail
- Values go in at a hidden prompt with no echo. A key has to be declared in the committed example file before a value can exist for it. Status output prints the length, a public prefix, and 8 hex of a SHA-256 as a rotation fingerprint, never the value.
- docs/ENV.md
- scripts/env.sh
- Enforcedverified 2026-08-07
The coding agents I run are denied every env file, key, and secret command.
- Blocks ·
- An agent reading a live credential into a transcript that then leaves my machine.
- Detail
- Read, edit, and write are denied on .env, .env.*, *.pem, and id_rsa*. The shell denials cover gh secret, vercel env pull, and supabase db reset. A pre-tool hook parses each command before it runs and snapshots destructive but recoverable git operations to a hidden ref instead of refusing them outright.
- .claude/settings.json
- Enforcedverified 2026-08-07
An unauthenticated request never reaches an admin route handler.
- Blocks ·
- A handler bug turning into an exposure, because the request stops before the handler.
- Detail
- Session lookup and an email allowlist run in middleware across the admin pages and the admin API. API calls get a 401 payload, pages get a redirect to the login screen.
- src/middleware.ts
/ Data and money · 08
What the database and the payment path refuse by default.
- Enforcedverified 2026-08-07
The database refuses writes by default.
- Blocks ·
- A leaked public key turning into a write, because no public write path exists to begin with.
- Detail
- Row level security is on for all 6 tables. There are 5 policies in total and every one of them is a public read. There is no insert, update, or delete policy anywhere, so writes are service-role only by omission rather than by rule. The billing audit table carries no policy at all.
- supabase/migrations/001_admin_content.sql
- supabase/migrations/002_billing_fulfillment.sql
- supabase/migrations/003_products.sql
- Enforcedverified 2026-08-07
A payment event cannot be forged, and cannot be counted twice.
- Blocks ·
- A spoofed fulfillment call, and a retried webhook granting the same thing twice.
- Detail
- Signatures are HMAC-SHA256 compared with a constant-time check, so a wrong signature returns 401 without leaking timing. Replay is stopped by a unique index in the database rather than by an if statement in application code, which means a race cannot slip past it. It has its own contract test and its own script.
- src/lib/billing/fulfillment.ts
- supabase/migrations/002_billing_fulfillment.sql
- npm run contract:verify
- Enforcedverified 2026-08-07
The site builds from a clean clone with no secrets at all.
- Blocks ·
- A build that silently depends on my laptop, and a content outage taking the site down with it.
- Detail
- Every content loader falls back to static files in the repo when the database is not configured. CI proves it on every pull request by building with an empty environment.
- src/lib/content/loaders.ts
- .github/workflows/ci.yml
/ The live surface · 09
What guards the deployed site and its public endpoints.
- Partialverified 2026-08-07
The one public write endpoint is rate limited.
- Blocks ·
- A script pointing the brief form at someone else's inbox and flooding it.
- Detail
- 5 requests per 10 minutes per IP, answered with a 429 and a Retry-After header. The endpoint also rejects header injection in the email field and caps the payload size.
- Limit ·
- The limiter is in-memory and best effort. On serverless each instance keeps its own window, so a determined flood spread across instances gets more through than the number suggests. A hard guarantee needs a rule at the edge, and that is written in the file rather than glossed over.
- src/lib/rate-limit.ts
- src/app/api/brief/route.ts
/ Not switched on yet · 10
What is missing, why, and what turns it on.
Every repository has gaps and a technical reader spots an all-green page in seconds. These are mine. A test in this repo fails the build if this list is ever empty, which is the only way I know to keep it honest when the page is also marketing.
- Off by choiceverified 2026-08-07
No human approval is required, because there is one human.
- Blocks ·
- Nothing. This is the gap, stated plainly.
- Why ·
- A required approval that I grant myself is a checkbox, not a review, and a checkbox dressed as a control is worse than an absent one. What covers part of it: the check is required, admins are not exempt, every change still goes through a pull request, and four agent reviewers read it first. What none of that covers: a logic error that the type checker, the tests and every agent all miss will ship. That is the real cost of a one-person shop and no setting removes it.
- Branch protection · main · required approving reviews: 0
- Not yetverified 2026-08-07
Linting is not part of the merge check yet.
- Blocks ·
- Nothing today. It would catch unsafe React patterns the type checker allows through.
- Why ·
- The step was left out while the existing lint debt was paid down, and the note in the workflow file still cites the original count. As of the verification date the real number is 7 errors and 10 warnings across 15 files, so the reason has outlived itself.
- Turns on when ·
- The error count reaches zero. At 7 that is a sitting, not a project, and it is the next thing on this list.
- .github/workflows/ci.yml
- npm run lint
- Not yetverified 2026-08-07
There are no browser tests.
- Blocks ·
- Nothing today. They would catch regressions in the hand-rolled pointer gestures.
- Why ·
- The gestures behind the mobile sheets and back swipes are covered only by a render-level smoke test. Adding real browser coverage is work rather than a toggle, and it has been losing to buyer-facing work. That is a priority call, not an oversight.
- Turns on when ·
- The first gesture regression that reaches production. If that happens I will say so here.
- Not yetverified 2026-08-07
The admin login route is not rate limited.
- Blocks ·
- Nothing today. It would slow credential stuffing against the operator login.
- Why ·
- The limiter exists and is wired to the public brief endpoint only. The admin routes sit behind a Supabase session and an email allowlist, so a guess has to beat both, but that is a reason it has not burned me rather than a reason it is fine.
- Turns on when ·
- The same limiter applied to the auth and password reset routes. It is a small change and it is on this list so it does not stay forgotten.
- src/lib/rate-limit.ts
- Not yetverified 2026-08-07
I do not set a content security policy or security headers.
- Blocks ·
- Nothing today. A policy would contain the blast radius of an injected script.
- Why ·
- Whatever transport security is in place comes from the hosting edge by default, not from anything in this repo. The app config sets no policy of its own, and I would rather say that than let a platform default read as my work.
- Turns on when ·
- A policy authored in the app config and checked into the repo, so it is a reviewable diff like everything else here.
- next.config.ts
- Off by choiceverified 2026-08-07
The pre-push hook on my laptop is not a control.
- Blocks ·
- Nothing that the server does not already block. It is listed so it is not mistaken for a control.
- Why ·
- There is a hook that refuses force pushes and direct pushes to main. It is untracked, it lives on one machine, and a fresh clone gets none of it. A check that exists only on my laptop is a habit. The server-side branch protection is the thing that actually holds, which is why it is listed first on this page.
- Not yetverified 2026-08-07
The GitHub-native scanners are off: CodeQL, secret scanning, push protection.
- Blocks ·
- Nothing today. Push protection in particular would stop a committed key at the push itself rather than after it.
- Why ·
- Not an absence of review, a gap in a specific layer. Agent reviewers read every pull request, including a security reviewer, but they are advisory and they reason about the diff. A native scanner is deterministic, runs against the whole tree, and does not have an off day. Two other things reduce the odds without replacing it: keys never enter the repo, because they live outside it and the agents are denied the files, and dependency alerts are on and read.
- Turns on when ·
- The three toggles switched on for this repo and the open advisory list cleared, after which these rows change state and get a fresh date.
/ Checking this page · 11
The receipts are checked by the same build they describe.
Repository paths above point into a private repo, so they are printed rather than linked: a link that 404s for every visitor is worse than no link. What stands behind them instead is a contract test that fails the build if a cited file is deleted, if a gap loses its reason, or if the ledger runs out of gaps. Some of the same files are readable in full through Source.