Buyerwise

Challenge

Buyerwise was a subscription shopping assistant designed to learn a household’s people, taste, and habits well enough to plan gifts, including surprises. That set a hard constraint: one AI agent would serve every member of a household but must never reveal a surprise to its recipient, not even by inference. No off-the-shelf LLM framework handles that. It had to be designed into the data layer, the authorization rules, and the agent’s prompts at once, and hold before the first feature shipped.

Process

The first phase was documentation only: 199 design docs and 26 append-only architecture decision records, one concept per file. They defined three privacy zones (household-shared, shared-with-recipient, and recipient-blind surprise), each enforced in the schema, row-level access, agent prompts, notifications, and UI. The same phase produced a 93-capability inventory for the agent and a catalog of 62 failure modes across 11 categories. Incentives were aligned by construction: the Lambda that ranked recommendations had no affiliate permissions at all.

Then the build, in slices against a written roadmap: a pnpm monorepo with compiler-enforced boundaries, the full test stack (Vitest, Playwright, axe-core, Testcontainers, Promptfoo) in place before the first feature, and SST-managed AWS infrastructure (Lambda Function URLs, Cognito, KMS envelope encryption, DynamoDB) across dev, staging, and prod. Every deploy was verified live on all three stages. An auth change counted as verified only when a real browser completed the full sign-in round trip, never when a redirect just returned the right status code.

Result

The marketing site, authentication, and core infrastructure reached prod and were browser-verified on all three stages. Buyerwise never launched and had no customers; I retired it in October 2026 and tore the infrastructure down. What remains is the design corpus: a product whose privacy guarantees, failure modes, and incentive separation were written and locked before the build, so the code answered to a contract instead of improvisation.