Field notes from a market-intelligence startup
From Laptop Prototype to Private Production Platform in Four Months
Two Python scripts on a laptop became a paid, private, audited platform between June and October. The code was rewritten; the discipline is what carried over. Here is the arc, with dates.
- Headline number
- 1,450 pull requests in four months
- Role
- Architected and led
- Category
- Field Notes
- Updated
Architecture
- Laptop prototypesJSON files, .env, free prices
- Port the logicJune 10 to 17
- Public container appsPostgres, Key Vault, CI
- Private networkcutover Aug 28 to Sep 3Incidents become controlsJul 7, Sep 6, Sep 15
- Paid platform~1,450 PRs, 100+ CI checks
Key takeaways
- Port the logic, never the folder. JSON files, .env secrets, and free price feeds all got replaced.
- Every production incident became a control within days, and the controls are tested
- More than 100 invariant checks run on every pull request, so two founders using AI coding agents ship safely
- Vibe-coding is how you find out what to build. Engineering is how you keep it.
The prototypes
In spring I had two scripts on a laptop. One classified stock signals from a chat community and paper-traded them, writing JSON files to a data folder and reading secrets from a .env file. The other detected coil and breakout setups with a small backtest harness. Both worked. Neither could be trusted with a customer.
When the venture formed in June, the temptation was to drag those folders into the repo. I ported the clean logic instead and left the state, the secrets, and the shortcuts behind. The first commit landed on June 10. The first deploy ran on June 12.
What changed, and when
The arc is easiest to see as a set of replacements, each with a date.
- Storage: JSON files and SQLite became PostgreSQL-only in production on June 17. SQLite stayed on as the offline test backend.
- Secrets: the .env file became a password manager at dev launch and Key Vault with managed identities in production. The database has no passwords at all, and CI fails if a template contains a real value.
- Hosting: laptop daemons became public container apps, then a fully private network with Private Link and an egress firewall. The cutover ran from August 28 to September 3.
- Prices: a free mid-price feed became a licensed vendor, market-only entry pricing, and an immutable audit log.
- Claims: the loose pattern detector was rewritten and tested with 347,000 point-in-time evaluations. The product claims were narrowed to match the result.
Incidents that became controls
Production teaches faster than planning. Three lessons, each dated, each now a tested control.
- July 7: the CDN hung real browsers while a curl health check returned 200. Uptime probes now run as browser-style tests from four regions with body-content matching.
- September 1 to 6: the edge firewall silently swallowed the security alert relay for five days. A daily heartbeat job and a silent-pipeline rule now make "no email" an alert of its own.
- September 15: an AI coding session read production rows by overriding a job command. A tested pre-execution hook now blocks any agent from executing against production, and a tripwire fires on manual job starts.
Shipping fast with AI agents, safely
Both founders write code with AI agents. That is the only way two people ship about 1,450 pull requests in four months. It is also why the guardrails matter more than usual. The repository carries written rules for agents, the core one being that an agent proposes a change and stops, and that a blocked task is an acceptable outcome.
Every pull request runs more than 100 invariant checks and self-tests: the egress allowlist against every outbound hostname, private-by-default on every template, parameterized SQL, token audiences, member-data isolation, a tracker denylist, and the secrets inventory. Deploys authenticate with OIDC pinned to the main branch, run migrations before the app rolls, and smoke-test production. A non-engineer co-founder opens pull requests through the same gate and ships safely.
The point
Vibe-coding is a legitimate way to find out what to build. Most of what I know about the product came from the prototypes. The gap between a prototype that works and a system people pay for is data discipline, identity, observability, and the willingness to let the data narrow your claims. That gap is the work I do.
Stack
Related work
Same discipline, different system.
Need this built inside your organization?
One person, architecture to deployment. Tell me what is stuck and I will tell you where I would start.