None of this process is new. Doing it every time is the hard part.
The industry has known for twenty years how software that does not fall over gets built: version control, code review, separate environments, reversible database changes, automated tests, and deploys that roll back. Almost no small project has any of it, and not out of ignorance — doing it all costs more than the project does. That is the only thing that is different here.
The process, end to end.
This is the lifecycle of any well-run software project. Nothing here is invented, and that is the point. The automation works on the three middle stages — build, review and testing — which are exactly the ones that eat the budget when they are done by hand.
-
1
Discovery
What has to be solved, and what does not. Scope is written down BEFORE the quote, because scope defined afterwards is how you end up arguing at delivery.
-
2
Design
Data model and architecture. This is where the fixed price and the fixed date come from: without this stage, an estimate is a hunch with two decimal places.
-
3
Build
The code, in version control from the first commit and in a repository under your name. Nothing is written straight onto production.
-
4
Review
A second reviewer, independent of whoever wrote it, reads the change before it is merged. If they break it, it does not move on.
-
5
Testing
It is checked automatically and the evidence is kept. "No error" does not count: there has to be proof the thing actually happened.
-
6
Deploy
To a staging environment first, then to production, and with a way back. If verification fails, the deploy rolls itself back.
What "evidence-gated" means
It means a stage does not advance because it looks fine, but because something proves it: the row in the database, the log line, the response body. That sounds obvious. It is not — most software is accepted because it did not visibly fail, which is a different thing entirely.
The standards, one by one.
Nothing exotic: this is what any serious team does. Knowing them is not the rare part — holding to them all the way through a small project is.
- Version control from the first commit, in a repository under your name.
- Separate environments. Nothing is tested in production.
- Database changes are versioned and reversible.
- Every change goes through an independent review before it ships.
- Automated tests that leave evidence behind, not a screenshot.
- The deploy runs dry first; if verification fails, it rolls itself back.
- Credentials never live in the repository.
- Handover documentation from day one, not on the day you want to leave.
Where the automation fits.
I built two assistants that work on top of that process: one prepares the change, and another, independent of the first, tries to break it before it ships. They decide nothing and sign nothing. They exist so the list above can be honoured in full on a two-week project, not only on a two-year one.
What the AI does not do
It does not decide, it does not approve, and it is not accountable. AI writes and verifies, the team builds, and I approve and answer for it: the guarantee is signed by me, not by a tool and not by an employee. And it is worth saying plainly, because almost nobody does: if the automation vanished tomorrow, the process would be exactly the same. It would take longer, and that is all. The tool helps; what holds the work up is the process and the person accountable for it.
What this process does NOT do
- It does not guess a scope you have not decided yet. If discovery does not close, there is no fixed date to give: it would be invented.
- It does not turn a month of work into a week. It removes the dead time between stages, not the work.
- It does not replace someone deciding. Every gate needs a person to approve it, and that person is me.
- It does not work on a project with no access to the code or a test environment. With nowhere to verify, there is no evidence — and without evidence this is a promise like any other.
This site is the case study
From an empty domain to production with TLS, bilingual, with structured data, and with a scanner shield that cuts 40% of traffic before it reaches the server. Every step is on the record with its evidence. If you want to see what a project looks like from the inside, you are looking at one.