A grant-discovery SaaS for Portuguese SMEs had been untouched since April 2026. In one working day, the AgentSprint engine audited it, fixed what was broken, shipped two epics of product work through review gates, and deployed it to production. This page links every claim to its artifact.
Everything below is verifiable in the client's repository — commit history, PR threads, CI runs.
The pipeline's spec→stories→gates structure, with the artifacts it produced.
Codebase read end-to-end before any changes: routes, schemas, queue processors, deploy scripts. Output: a fallacy report separating what the docs claimed from what the code did — including three dead pages and an unwired token-budget guard that docs described as active.
Spec written from the audit, decomposed into stories, each implemented TDD-first behind its own commit. Result: wildcard CAE matches eliminated, region vocabulary canonicalized, one scoring path shared by API/batch/refresh, unknown criteria fail closed, and a 35-case golden calibration gate that caught a real macro-lookup bug on first run. → PR #189
Free tier actually gated server-side; eligibility reports moved to double opt-in with a new confirmation surface; stored reports became server-computed (client payloads rejected); scraper put on a weekly cron with automatic deadline sweeps; seeder future-proofed so demos never show expired grants. → PR #190
Real SAF-T (PT) XML parser replacing a stub; AI Evaluator v1 on a live route with structured outputs and confidence bands; stale claude-3-haiku defaults replaced with current models; the long-dead token-budget guard finally wired into every AI path. → PR #191
VPS recovered from disk exhaustion, app redeployed and verified live; zod major split (v3/v4 across packages) closed; OpenAI SDK 4→6; dependabot backlog triaged with explanations on every closed PR. Docs updated to match reality. Then the site itself was used like a customer would use it — which found more.
Created a throwaway account on the live app and drove it end-to-end. Found and fixed: a BullMQ job-id bug 500-ing every report request; a login loop that bounced every registered user out of the dashboard (container couldn't reach its own public URL); and missing signup provisioning that left new users with a permanently broken workspace. Each through its own reviewed PR: #193, #194, #195.
Three representative bugs from the audit and self-test phases. The pattern is the point: the pipeline verifies claims against behavior, not vibes.
The 35 independently-derived golden cases weren't decorative — on their first CI run they failed against a macro-region lookup error that manual review had missed. Fixed before merge.
BullMQ rejects custom job ids containing ':'. Every eligibility-report enqueue threw at runtime while all unit tests passed. Live POST returned 502; after the fix it returns {sent:true} and the verification email lands.
The session middleware fetched the auth check from a URL the container couldn't resolve — infinite redirect to /login for everyone. Fixed with container-to-container routing; verified by driving seven authenticated pages with a real session.
Every fix lands with the reasoning attached — this is what "review-gated" means in practice:
# fix(api): BullMQ job ids cannot contain ':' — join with '-'
# (broke report-request enqueue on prod)
- return `${orgPart}:${userPart}:${data.type}:${channel}:${fingerprint}`
+ // BullMQ forbids ':' in custom job ids.
+ return [orgPart, userPart, data.type, channel, fingerprint].join('-')
# Tests: 151 passed (151) — then deployed and re-verified
# against the live service: {"sent":true,"verifyRequired":true}Same project, same day — things the pipeline flagged as still open rather than claiming victory:
The build requires non-empty price IDs; placeholders are running until the client creates real prices in Stripe. Stated plainly in the handover, not hidden.
App is live on its tailnet funnel URL; pointing eurofundos.eu needs registrar access only the owner has.
Transactional email sends via Resend but from an unverified sending domain — deliverability work queued.
A dormant repo, a half-built feature, a migration nobody wants to touch — same pipeline, same receipts.
Book intro call Back to overview