I build production software by running AI like an engineering team.
I design the system and write the specification. AI agents write most of the code. Automated tests check every change before it ships, and security audits try to break it.
A process, not prompts.
AI is fast but confidently wrong. Every step around it exists to catch that before a customer does.
- 01Specify Written design before any code. 58 specs and plans for TotalHost.
- 02Plan Small steps, each checkable on its own.
- AIAgents build Claude Code writes most of the code. I review and steer.
- 04Test ~6,700 automated tests, run in CI on every change.
- 05Audit 34 declared security rules. An audit skill I built tries to break each one.
- 06Ship Infrastructure as code, deployed through a locked-down pipeline.
TotalHost
Bookkeeping and VAT for Finnish Airbnb and Booking.com hosts.
Hosts forward receipts and bank statements. TotalHost keeps double-entry books, reconciles the bank, prepares VAT and closes each month. The host sees profit per apartment and what they owe the tax office.
- Ledger can't be edited after the fact. Each entry is hash-chained to the one before, and the app can only add rows, never change them. Try it below.
- Filed VAT periods are locked by the database itself. Corrections go in as new entries, so filed numbers can never drift.
- Each client's data is walled off inside Postgres: 127 row-level security policies, tested end to end.
- Receipts by email: a private address per client, with spam and virus checks.
- OCR that knows its limits: it only fills fields it's at least 85% sure of. The rest go to a person.
- Direct filing client for Verohallinto's API over mutual TLS, built and tested, not switched on yet.
Try to change the books.
Four ledger entries, each one sealed with a SHA-256 hash that includes the previous entry's hash. Change a past amount and watch what happens.
hash c539f71e8b50…
hash c300e1afcd29…
hash adf994655696…
hash 1a09f9d5f911…
Jard
Yard-work marketplace for the Helsinki area. Homeowners name a price; vetted local workers take the job.
I built the iOS app, the website and the backend, and I run them in production. Customers post a job and set the price; workers accept or counter; a €5 service fee is charged when the customer picks one.
- Payments that can't double-charge: the job is claimed in a database transaction before the card is ever charged.
- Security rules attacked by 77 tests on every change: fake ratings, free leads, promoting yourself to worker.
- Contact details stay hidden until a booking exists, with Finnish-aware filtering of phone numbers and emails in messages.
- Cost and abuse controls: an automatic billing kill-switch, rate limiting, bot protection, and location data stripped from photos.
- Silent over-the-air updates that install during the splash screen.
The setup behind it.
What I built to make AI reliable enough for production work.
Six hooks: context loading, test and lint gates, and an independent review on any change that touches money.
A security audit against declared rules, a capacity check, and a skill that lets AI watch and critique video.
Strategist, copywriter, designer and more, with a brand guardian that can reject any draft. It wrote the text of Jard's App Store listing.
Writing a Claude Code course from fifteen real mistakes and what fixed them.
More work
- LaudaturJul 2026
A matriculation-exam trainer. Spaced repetition, 664 sourced questions, and Claude grades essays against the exam board's criteria.
- Video as codeJul–Sep 2026
Jard's social videos, built as code in Remotion, with tests on the numbers they show and an automated check that catches frozen frames.