Confexio

Building it

It’s a monorepo of four apps: a Next.js backend and organiser dashboard, an Expo app for attendees, a Payload CMS for event sites and emails, and an internal ops app, each with its own database and deploy. Supabase Postgres sits under the product, with row-level security doing the access control. AI coding agents wrote most of the code, so a lot of the engineering went into the system around them: plans, review, a seeded QA world and recorded evidence before anything ships.

• The problem

  Releases made by the bot triggered nothing. Pushes made with GitHub’s default token don’t start other workflows, so release PRs hung and tags would have deployed nothing.

  The fix

  release-please runs as its own GitHub App, so its PRs and tags start the downstream deploy workflows like any human push.

• The problem

  Choosing between an over-the-air update and a new native build. Diffing git missed runtime-version bumps made mid-cycle and builds that had failed earlier.

  The fix

  On each tag, the pipeline asks EAS directly whether a production build exists for that runtime version. If one does, it ships an OTA update; if not, it builds and submits to the App Store. This is the third version of that logic.

• The problem

  A production migration that had never run on staging, or a bad web build going straight to the live domain.

  The fix

  Migrations are additive-only, and a parity guard checks through the Supabase Management API that every pending one is already in staging’s history. Web builds deploy with --skip-domain, get smoke-tested on that URL, and only then are promoted.

• The problem

  A workflow that failed by succeeding: release-please ran green for months without cutting a tag, so no failure alert ever fired.

  The fix

  Daily heartbeats whose absence pages my phone, alongside failure alerts on every workflow.

• The problem

  Durable workflows replay from a log, so any side effect in the workflow body would send the same email twice.

  The fix

  Every read, write and send lives in its own step. Delays sleep in chunks of at most a day and re-read the event date when they wake, so moving an event corrects reminders that are already in flight.

• The problem

  Late sign-ups: someone who registers 20 hours before an event would get every reminder they’d missed, all at once.

  The fix

  Steps are skipped by comparing against the person’s fixed enrolment time, not the clock, so the decision stays the same when the workflow replays.

• The problem

  Delivery webhooks arriving out of order, twice, or before the send had even been logged.

  The fix

  Status only moves forward by rank (sent, delivered, bounced, complained). A webhook for an unknown send writes a placeholder that the real log row later merges into, and the event id is claimed in the same transaction, so a failed apply rolls back cleanly and Resend retries.

• The problem

  Sending the same thing twice, or flooding attendees when an organiser makes several edits in a row.

  The fix

  Idempotency keys at enrolment (a unique constraint) and on every Resend call, a 10-minute coalescing guard on automated event-wide notices, a per-person weekly cap and a global bounce list.

• The problem

  Multi-tenant access was open on create. Payload never checks a create rule against the incoming data, so one organiser could have created a page in another’s workspace.

  The fix

  Every create rule checks the incoming tenant itself, and draft versions declare their own read access instead of inheriting it.

• The problem

  One block schema with four consumers (the database, the TypeScript types, the AI’s output validation and the React renderer) that must never drift apart.

  The fix

  Types and validators are generated from the schema and checked for drift in CI. Each block is capped at 16 variants, the largest union Anthropic’s structured-output decoder accepts.

• The problem

  Media uploads: newer AWS SDKs add a checksum header that R2 rejects, and Vercel caps request bodies at 4.5 MB.

  The fix

  Checksums are set to only-when-required, and browsers upload large files straight to R2 with presigned URLs.

• The problem

  Stripe webhooks must take effect exactly once but still be safe to retry.

  The fix

  Every event lands in an inbox table keyed on provider and event id, and only rows marked done are skipped. Changes go through idempotent database functions, and each webhook is checked against the stored order’s account, currency and amount before it can mark anything paid.

• The problem

  Moving the platform to a new Stripe account without breaking organisers’ connected accounts.

  The fix

  Each merchant row is stamped with the platform account it belongs to, so a swap is just a key rotation: rows from the old account stop being used on their own.

• The problem

  MCP tools had to respect Postgres row-level security without a browser session to borrow it from.

  The fix

  The server mints a five-minute token for that person on every call, flagged as MCP, and it never leaves the server. The public API rejects any token carrying the flag, and no admin database client sits on a tool’s data path.

• The problem

  An unanswered approval card broke every later turn in the same conversation.

  The fix

  Approval state is stripped from every message except the latest before the history goes back to the model.

• The problem

  Several agents working in one checkout kept tangling each other’s changes into the same commits.

  The fix

  One branch and one PR per piece of work, with each agent’s commits restricted to the file paths it owns.

• The problem

  Realistic test data without real people’s data.

  The fix

  A deterministic sanitiser replaces names and photos on scraped real conferences but keeps the programmes. To reproduce a bug, a pseudonymised slice of production is pulled into the local stack.

• The problem

  The cockpit spawns Claude Code with write access to the repo, which would be remote code execution if it were ever deployed.

  The fix

  Every cockpit route returns 404 unless it’s running locally, outside production, next to a real .git folder, and a test fails the build if any handler skips that check.