Buyerwise

Challenge

Buyerwise is a subscription personal shopping assistant that learns a household’s people, taste, and shopping patterns well enough to plan gifts, including surprises. That last part creates a hard constraint from day one: the same AI agent serves every member of a household, but must never reveal one member’s surprise-gift plans to the person the gift is for, not even by inference. There is no off-the-shelf LLM framework that solves that; it has to be designed into the data layer, the authorization rules, and the agent’s own prompts simultaneously, and it has to hold before a single feature ships, not after.

Process

I spent the project’s first phase entirely on documentation: 199 design docs and 26 append-only architecture decision records, cross-referenced under a one-concept-per-file rule, defining a three-zone privacy model (household-shared, shared-with-recipient, and surprise/recipient-blind) enforced redundantly across schema, row-level access, agent prompts, notifications, and UI. The design phase also produced a 93-capability inventory for the agent and a catalog of 62 failure modes across 11 categories, written before any product code existed. Incentive alignment is enforced by construction, not policy: the affiliate-transparency decision record commits to algorithmic separation, so the Lambda that ranks recommendations is granted no affiliate permissions at all.

Only after that surface was accepted did I start the build, in slices against a written roadmap: a pnpm monorepo with compiler-enforced architectural boundaries, the full testing stack (Vitest, Playwright, axe-core, Testcontainers, Promptfoo) scaffolded before the first feature, and SST-managed AWS infrastructure (Lambda Function URLs, Cognito, KMS envelope encryption, DynamoDB) stood up across dev, staging, and prod. I set the verification bar deliberately high: every deploy is verified live on all three stages, and an auth change counts as verified only when a real browser completes the full identity round trip and proves an authenticated session, never when a redirect merely returns the right status code.

Result

Deployed at buyerwise.co (the .co domain is itself a locked decision record), with the marketing site, authentication, and core infrastructure live and browser-verified across dev, staging, and prod. It is pre-launch with no customers; the shopping agent’s capabilities land slice by slice per the build roadmap, and purchase automation is explicitly out of v1 scope by decision record. The distinctive artifact here is the design corpus itself: a product whose privacy guarantees, failure modes, and incentive separations were specified and locked before the build, so implementation answers to a written contract rather than to improvisation.