CASE STUDY · LIVE IN PRODUCTION

Pilot

A project and task management SaaS I built end to end — API, SPA, CI/CD and operations — with my own agentic SDLC toolkit: spec → architecture → tested, reviewed, deployed PRs.

Open the app ↗Swagger API docs ↗Backend repo ↗Frontend repo ↗

Rails 8 APIRuby 3.3, PostgreSQL 16, Redis 7, token auth, rswag docs.

React SPAReact 18 + Vite + TypeScript, runtime config, hashed bundles.

Kamal 2One Docker image per commit, dev on every merge, prod from a tag.

RollbackHealth checks, smoke tests, 10-minute release watch, one-click rollback.

Why I built it

I wanted proof that my agentic SDLC holds up beyond a demo: a real product, two repositories, two environments, real users signing in, and releases I'd trust on a Friday. Pilot is that proof — every feature went from a Trello card through PRD, ADRs and task briefs to a reviewed PR and a deploy.

Architecture

Backend: Rails 8 API-only on Puma. PostgreSQL 16 for users, projects and tasks; Redis 7 as the cache for list endpoints. Bearer access tokens, with a documented migration path from legacy headers (ADR-0005).
Frontend: React 18 + Vite + TypeScript, served by nginx. API URL, error DSN and environment name are read from /config.js at container start — never baked into the bundle.
Errors: GlitchTip through the Sentry SDK on both sides; the SPA relays browser errors through the API's /api/errors tunnel.
Docs: OpenAPI generated from request specs (rswag), a C4 container diagram and an architecture map with conventions and known debt.

Shipping safely

CI builds one Docker image per commit; it is promoted to production, never rebuilt.
Every merge into develop deploys to dev automatically with Kamal 2.
Production deploys only from an annotated vX.Y.Z tag on main, with a typed confirmation; the frontend waits for the matching backend release.
Each deploy waits for /health to report the new release and runs a smoke test against the Swagger document.
Production is watched for ten minutes and can be rolled back from the console or GitHub Actions.

Quality gates

RSpec + FactoryBot on the API; ESLint, tsc, Vitest and npm audit on the SPA.
gitleaks over the full history, actionlint, and a public-repo check: no internal hosts, IPs or DSNs in tracked files or the built bundle.
TDD commit order, branch and PR conventions, and an AI review workflow — all checked in CI.
CI jobs can run on a self-hosted runner from my homelab.

Built alone, operated like a team: specs, ADRs, gates, release notes and a rollback I've actually tested.