Alberta, Canadadave@rightsideroofing.cacurrent as of 2026-10-14
I run Right Side Roofing (est. 2014). Since 24 June 2026 I have directed an AI engineering
organization that built ATLASS OS: not four apps that finally talk, but an operating system for a trades business, with real double-entry books. It also built
FieldOps, its Android field-app family. My contribution is the system that governs the work.
The first part is an org runtime that turns a punch-list row into a shipped feature through plan, build, refute,
judge, drive, redteam, gate and ship, with GUI and MCP parity as a structural rule. The second is the FFA machine,
a feature factory in which the maker never grades itself. I am not a professional developer and not an
accountant, and I hold no certificates; I am pursuing the ones the work requires.
Core Skills
Org-runtime designOne Overseer post works a punch list. Each row gets a Builder on its own lane worktree and one Opus refuter on the lane diff. A release hold, a merge-back gate and release notes before every push. The conductor daemon and per-seat bus were retired for direct sub-agents (2026-09-20), and boot cost fell from ~35k to ~3k tokens.
Model and compute routingThe model is pinned on every spawn: Fable for the post, Opus for judgment and money, Sonnet for mechanical edits, Haiku for monitors. Heavy jobs run remote-first across four registered hosts under one org-wide heavy-gate lock. Owned GPU inference (PaddleOCR, faster-whisper) is pull-only, so prod never calls in.
Deterministic guardrail engineering139 gate scripts and 387 selftests, run red-first so each gate is proven able to fail. 240 CI gate steps run ahead of migrations and deploy. A 23-item release checklist where "could not check" (exit 2) stops a release exactly like a failure.
Money and tenancy invariantsMoney asserts A0–A9 that may not call the code they audit. A tenant-scoping scanner whose itemized exceptions can only shrink. An audit log made append-only at the database by trigger, revoked grants and ENABLE ALWAYS.
MCP and agent-surface design217 MCP tools served on prod. Access control lives at the endpoint, not the token (owner doctrine 2026-09-04, now a gate). Agent tokens are frozen at mint with a sha256 seal, and refusals tell the agent how to fix the call.
Incident-driven iterationEvery rule is a scar from a documented failure, fixed in the instrument rather than the human. "I verified" means a check that could have failed. An owner instruction becomes an SSOT with a seat, a trigger and a failing gate, or it is recorded as a wish.
Selected Measurements
112 daysof git history (first commit 2026-06-24)
12,069commits on the trunk
254production snapshots on main; 63 cuts in the 15 days to 2026-10-14
176release notes, each written before its push
1,104API routes (generated route table)
589React components (.tsx)
196migration files, keyed by filename
217MCP tools served on prod; 72 of 216 benchmarked
FFA machine: 192 tasks across 11 modules, 124 green (bank 33/33, AR 49/50, AP 15/15, GST 12/12,
payroll 15/18). The procurement whole-module review converged 18 → 8 → 4 → cleared on 2026-10-14. The safety gate
passed 124/124 arms and killed 210/210 mutants.
Release discipline: at cut 28dz (2026-10-14) the fast sweep ran 91 steps, 77 green and 0 red. Checklist item 12
read EXIT=1 and was recorded deliberately, with the reason written into the release notes.
Parity: all 1,112 numbered punch-list rows carry a GUI/MCP Parity line, and 366 of them name both a screen and an MCP door.
Access control, measured rather than claimed: 83.3% of mutating doors and 94.6% of money doors enforce
session plus permission (endpoint census 2026-10-04), down from 275 gaps on 2026-09-12.
Recoverability: a prod dump was restored and verified on 2026-10-04: 351/351 tables, and the money invariants were green
on the restored copy.
Delivery speed: FieldOps went from its first commit to v0.22.0 in 30 days, with 206 commits and 42 release notes.
Unit economics, self-recorded telemetry (2026-08), reported in both directions: a full end-to-end repair
for $28.51 in 28 minutes, against a $202.52 day that produced zero new green tasks. Roughly 30.6 hours and $782 per
module, with about 93% of cost spent on input processing.
Sources for every figure: proof-sheet.md, sections R and §01–§18.
Every owner order becomes a punch-list row with a holder, a date and a Parity line. A gate flags any owner order with no
row, so ordered work cannot be silently dropped.
A Builder per row on its own lane. One Opus refuter per lane, starting from refute. A FAIL goes back to Build.
On Receive Payment, two FAIL verdicts caught money bugs before the merge, including AR ≠ GL by a settlement discount.
Drive: a cheap model must use the feature through its MCP tools alone. Redteam: six pre-registered refusal probes, 35/35
(2026-09-02).
Ship: main only takes squash snapshots of the trunk, every push to it is a deploy, and no push happens without release notes written first.
The FFA machine: a feature factory
Feature-development automation · running since 2026-08-03
The conductor is a script, not an agent, and the only writer of an append-only ledger (2,692 events). The ratchet
never reverses. Each task climbs a stage ladder from authored to green, with api, ui and mcp each stamped by an independent gate.
The maker never grades itself: refuters review through tenancy, money and migration lenses, then judges correct the
refuters' claims, then a Haiku driver must operate the feature through the sandboxed MCP gateway.
A safety gate (merged 2026-10-02) blocks any route to prod, makes money invariants a hard fail, and halts on a critical until the
Overseer post clears it. A merge fence refuses any resolution that shrinks an append-only ledger.
Stated plainly: parked by the owner until the 2026-10-17 account reset. Its newest module, procurement, lives on the ffa tree
and has not yet crossed into the trunk or prod.
Security and trust controls
SOC 2-sensitive controls, not yet audited
Append-only audit log at the database, with before and after measured on prod 2026-09-04. Every query is scoped by business, and RLS is
the backstop.
Idempotent money doors: a replay returns the stored result and writes nothing (219 of 224 money doors carry the
signature). Agent deletes are soft only, enforced by a gate that found three hard-delete doors on its first run.
Backups are restored, not just taken, and the backup floor is a precondition of every release.
“Perfect memory” and field checkpoints
ACAT · FieldOps
ACAT runs two passes over one append-only mentions table: Layer 1 is deterministic, in milliseconds, before any model is
called; Layer 2 is inferring, async, appended, and never overwritten. Recordings with speaker turns shipped 2026-10-14.
Automated crew checkpoints (travel, pick-up, vendor stop, site departure) are stored as events keyed by the phone's own event
id, with the day's state derived from those events. The rules came from a dogfood day as foreman (2026-09-28).
Method
"The code tells you what it does, not which of its behaviors the human is actually seeing."
project note, after six failed agent sessions and seven re-explanations on one input-handling defect
Show the red gate. A release note that records an EXIT=1 on purpose, with the reason, is worth more than a
page of green. The punch-list gate and the lane merge-back gate are red today, and I say so.
A wrong theory must be banned in writing or it will be re-derived. I wrote numbered, verbatim symptoms and an
explicit banned-theory list, and told the agents to trust those over anything they inferred from the code.
Fix the instrument, not the autonomy. When a long session ran at an invisible low-effort setting, the
response was a visible effort indicator in the status line, not less autonomy.
Repeal your own overreactions. A knee-jerk limit on agent fan-outs was measured, repealed, and replaced with
a narrower rule.
Human attention is the scarce resource. A question with a derivable answer is agent work. Routing it to
the human is a defect, not diligence.
Ventures
Right Side Roofing: Founder / Owner-Operator
Alberta · established 2014
Roofing contractor and the first company to run on ATLASS OS: its own job sites, its crew day and its phone line.
Twelve years of running my own books on a QuickBooks Desktop mental model. The problem that started everything, in my
own words: "I was losing leads in the cracks and typing the same job into four places."
ATLASS OS: Founder, acting technical lead
Business OS for the trades · 2026 – present
Moved off a hosted AI app-builder onto its own codebase (first commit 2026-06-24). It runs on PostgreSQL, deployed by CI after
240 gate steps. CRM, projects and boards, double-entry books, payroll, a phone system, documents and scanning, and an
MCP surface all share one tenant database. It is an operating system the business runs on, not a bundle of apps.
FieldOps: Founder
Android field-app family · 2026-09-13 – present
One foundation, four flavours (FieldOps, ScanSnap, ProjectCam, CanvassCam), with no back end of their own: every byte
reaches ATLASS through narrow per-device bearer doors. v0.22.0 on 2026-10-13.
Flix-Fix: Founder
A personal media taste-graph product exposed to the user's own AI through an MCP connector: the data source and the actuator, not the recommender.
Status, Stated Plainly
Pre-revenue. The first paying customer is my own company. No certificates; pursuing. SOC 2-sensitive controls are
built and gated but not yet audited. There is no attestation and no external pen test. MFA is not built yet, and CSP is
report-only by design. RBAC coverage is 83.3% of mutating doors, not 100%. The FFA machine is parked until 2026-10-17, and
its newest module (procurement) is not yet on prod. Cost and throughput figures marked as telemetry are self-recorded, not a billing export.
One person, no bench.