The setup
A Dutch services marketplace — a customized LaraClassifier / Laravel 12 stack — was being rebuilt by an external development agency. I wasn't writing the site code, and had no local PHP toolchain. What I did own was whether what they delivered was correct.
So the question became: what can an AI layer do around someone else's delivery? Four workstreams answered it.
1. Codebase onboarding + security review
Documented the unfamiliar codebase into a CLAUDE.md onboarding doc, then ran a security audit with parallel subagents each hunting a specific class — authorization, authentication, IDOR — and triaged the findings for the agency's team.
Also QA'd a design ticket end-to-end with Playwright, delivering an HTML test report with screenshots. Zero lines of application code touched.
2. The redesign QA harness — measured, not opinionated
This is the piece that changed the working relationship with the agency.
Design review is normally a person squinting at a staging site and writing subjective feedback, which the agency can argue with. So I turned it into a measurement instrument:
- Read the Figma design exports and design-token CSS for expected values
- Drive the staging site with Playwright at desktop (1440×900) and mobile (430×932)
- Measure actual values via
getComputedStyle - Diff design against build
Findings land in qa-findings.json with stable check IDs, so a re-run produces a fixed / still-open / regressed delta rather than a fresh set of opinions. Every finding ships with the CSS fix attached.
Why it had to work this way: without a real browser, an LLM guesses from stylesheets and gets it wrong confidently. Measured numbers hold up in a dispute with an agency; adjectives don't.
Three-plus delivery rounds QA'd this way, and the method plus the prompt were documented so the agency could run it themselves — the goal was a regression suite they own, not a dependency on me.
3. The price guide content pipeline
Launch needed price-guide content. I first researched and audited real Dutch market prices for 25 service categories against the delivered design, then built a zero-dependency Node pipeline generating bilingual (NL/EN) price guides across 4 price regions.
Scaled out: 48,025 city × category CMS rows — roughly 1,921 Dutch cities × 25 categories, about 119 MB of CSV — each with copy, price cards, FAQs, provenance, SERP previews and JSON-LD.
Architecture: hand-edited sources plus cited corrections → generated verticals → dist, with machine-checkable gates between every stage. Nothing exports unless every gate passes. Generated directories carry _GENERATED.md markers and are never hand-edited.
4. Generalizing it
The price-guide method got extracted into a reusable playbook, then used to generate four more content blocks in a single day: 74 verified quality marks, SEO content, how-it-works steps, and 150 unique bilingual FAQs — each with schemas, validation gates and handoff docs.
What shipped
- Security findings list + codebase onboarding doc for the agency; Playwright-based ticket QA report
- 4+ re-runnable design-QA HTML reports with machine-readable regression tracking, plus a reproducible method
- Price guide dist: 25 national baselines, 100 regional payloads, 50 finished sign-off guide pages (NL+EN), and a 48,025-row per-city CMS import at 95.3% province coverage. Statutory prices kept exact and never regionally adjusted.
- Four further launch-ready content blocks, built in one day from the playbook
What we learned
Assert that a transform actually changed something. A non-breaking-space-vs-space bug made a regex silently never match. Every region's output was byte-identical — and every gate passed. Gates have to catch the vacuous pass, not just the failure.
Scope your guards tightly. A statutory-value protection matched by substring and froze an unrelated €1.700 price range. Match whole values, scoped to the rows that declare them.
Treat grammar as data. Templates produced "Een zonnepanelen kost…" for plural nouns in 5 of 25 verticals. The fix wasn't more template branches — it was deriving grammatical form from the source copy itself instead of assuming a form.
Risk-class your claims. Ordinary claims need source plus date citations. Statutory facts are exact single values with a review cadence. Third-party claims like quality marks carry the highest legal risk — cite the scheme's own rules, and never assert which providers hold a mark.
Measured QA beats opinion QA. Stable check IDs, browser-measured values and an attached fix turned design review from subjective feedback into a regression suite the agency accepted.
Enforce the generated-vs-source contract. Edits to generated files are silently discarded. Markers and a project skill were both needed before that actually stuck.
How it was done
Solo, with the coding agent as the workhorse: subagent fan-outs for audits and research, Playwright MCP for real-browser measurement, a Stop hook as an autonomous "keep working until all 25 guides are done" loop, and self-authored playbooks and skills so every stage was reproducible by a fresh session — or by the agency, without me.