timurista.ai: rebuilding this website in a day, with sign-off at every step

A consulting site that sells verification has an awkward requirement: it has to survive verification itself. Every claim on it is something a prospective client can check. A careful one will start by asking whether the numbers on the homepage come from anywhere.

Until this week, timurista.ai would have failed that check. It had a stale positioning, a cost figure I couldn’t source, placeholder pages with invented episodes, and an API deploy path that had quietly stopped mattering. This is Part 9 of Human in the Loop, about the rebuild: what I scoped, what I signed off on, what I sent back, and the bugs that got past review anyway.

As in the other parts, coding assistants drafted most of the implementation. I owned the brief, every review, and the call on what went live. The git history is the evidence, so I’ll start there.

What the log shows, and what it hides

The history is short and uneven. Seventeen commits run from Saturday, September 12 at 18:45 to Monday, September 14 at 16:15. The first, 4f3ce99 Redesign site around AI cost consulting , touches 58 files with 2,834 insertions. That’s not how the work happened, only how it was committed. The brief, the drafts and several review rounds all happened before that commit, and git has no record of them.

So I won’t put a clock on the design work. What git does show is the order of sign-offs after the first push, and that’s the part worth reading. Three commits in 84 minutes took the public site live. Everything after that is correction, hardening, or new surface area, and most of it started with me looking at the live result and disagreeing with it.

The brief came before the pixels

Before anything was drafted, I wrote down four constraints I didn’t want relitigated on every page.

• Lead with cost attribution. The site is for teams whose AI and cloud spend has grown faster than their ability to explain it. Everything else is supporting evidence.
• A palette with rules. The “ledger” system is dark ink #0B0F14, signal teal #35D0B0 and amber #F2B544, and amber is only for money. A reader should be able to spot a dollar figure from across the room, and every decorative amber accent dilutes that.
• Published cash-pay rates, and a fit check instead of a contact form. Someone who reads the rates and still wants to talk is already half qualified.
• Articles are content, not pages. Writing and case studies live in Astro content collections with a typed schema. The schema had a draft flag from day one, and every listing, route and cross-link filters on it. That’s why this post doesn’t exist in public until I flip it.

The first commit also covered the mobile work I count as part of “done”: a full-screen menu, a sticky fit-check bar, and no horizontal overflow on any page. Articles got a follow-up an hour later. Long inline identifiers now wrap with overflow-wrap: anywhere, and wide tables scroll inside their own box instead of pushing the page sideways.

Sign-off 1: the framing was wrong, so I pulled it

The series launched as “Built with Agents.” The first three articles led with how much of each codebase an assistant had drafted, and the charts matched.

Reading them live, I didn’t like what they said about the work. A share-of-commits chart answers a question nobody hiring me asks. What they want to know is whether I can run a delivery process where quality holds up once implementation is cheap. That’s scope, review, tests and gates, and those charts showed none of it.

Sixty-six minutes after the launch commit, 8a11708 Reframe series around human-managed delivery and validated quality renamed the series to Human in the Loop. It rewrote all three articles around how the work was checked, and swapped the authorship charts for validation charts: bugs from cause to fix, test growth, a decision timeline. The articles moved to new slugs, and _redirects gained eight lines, with and without trailing slashes. Every link shared in that first hour still lands, via a 301.

Sign-off 2: every number needs a source

I’d been quoting TrendVesting at roughly $1.50 to $2.00 fully loaded per signal, on the about page and in the API’s info endpoint. When I asked where that came from, the honest answer was a July estimate that divided a bill by a guessed signal count. Part 2 explains why it didn’t survive. The rebuild’s first commit removed it from both places before anyone could quote it back to me.

The same rule caught more on Monday. Those finds were more embarrassing, because they’d been sitting there longer.

Employer framing. Older copy described past big-tech work in the present tense, as if it were my current job. b3eb2f7 Describe past experience, not a current role fixed the bios on Sunday. On Monday afternoon a follow-up over-corrected and stripped every employer name. Three minutes later I reversed it: 32812fd Name past employers in passing restored past-tense mentions and added a footer line saying nothing here represents them. Deleting context doesn’t make it accurate.

Placeholder pages. Several pages were left over from an older version of the site. The books and podcast pages had invented episodes with 2025 dates, a dead repo link and an empty store link. The projects page linked to repositories that return 404. A services page carried a testimonial I couldn’t attribute and savings figures that had already been retired as unverified. The about page linked to a press kit that never existed. Three commits between 16:13 and 16:15, starting with ce648aa Hide placeholder books and podcast pages , took all of it out of the build and redirected the old URLs to pages that are real.

Sign-off 3: the form that showed my number to everyone

The fit check on /hire is a TendForm form embedded in the page. The last few answers decide what you see next. If you’ve confirmed the engagement is cash-pay, you want to talk this week, and your budget isn’t in the lowest bracket, a heading and a paragraph with my callback number appear. Otherwise you get a note about following up by email, or a pointer to the free writing.

The first version got this wrong in the most direct way possible. In TendForm’s markdown, a visibility condition attaches only to the line directly above it. The heading was gated, but the paragraph under it, the one with the number, wasn’t. Whatever someone answered, the number was on screen.

No build step or page check on this site could catch that. The site only embeds a URL, and the bug lived in a form definition on another service. The check that does catch it is walking the form as the respondent you mean to exclude.

The fix had two parts. Every revealed block now carries its own copy of all three conditions: the heading, the paragraph, and each alternate message. And any edit to that form comes with a rule: read the stored definition back through the API and confirm that every block with anything sensitive in it has its own visibility rule. The stored definition as of this writing shows both callback blocks carrying all three conditions.

Motion that has to earn its bytes

Saturday’s third commit, 9fde445 Add premium motion layer , added the parts most likely to go wrong on someone else’s laptop. That meant a Three.js “attribution field” in the homepage hero, a gate-flow canvas, view transitions and scroll reveals. I signed off on three conditions, and the code meets all three.

• Load it only when needed. The hero scene is a dynamic import. An IntersectionObserver pauses it offscreen, and it also pauses when the tab is hidden.
• Respect reduced motion. With prefers-reduced-motion: reduce, the scene draws one still frame and scroll reveals show their content immediately.
• Survive navigation. Scripts re-initialize on astro:page-load, so a view transition doesn’t leave a dead canvas behind.

The backdrops behind the Approach, Work and Hire headers are public-domain NASA photos of the Pleiades supercomputer and a tape library, duotoned into the palette. Each one carries its credit on the page. Public domain doesn’t mean uncredited.

The Worker that shadowed the new API

In July I moved the site’s API from a standalone Cloudflare Worker to Pages Functions, so /api/* would deploy with the site. The commit message noted a catch: the API token couldn’t manage zone routes.

That mattered more than it looked. The old Worker’s config still had routes for timurista.ai/api/* and api.timurista.ai/*, and on Cloudflare a Worker route on a path runs ahead of Pages Functions on that path. Pages deploys succeeded, the Functions were correct, and requests on the custom domain could still land on the old Worker. Nothing errored, which is exactly why nobody noticed.

On Sunday morning 896571e Fix worker deploy config made the old Worker’s config valid again, so it could be managed at all. An hour later, eade30e retire standalone API worker from deploy-all took it out of the deploy path, and the Makefile now keeps it only for emergency rollback. One item is still open: the token can’t list or delete zone routes, so clearing any orphaned routes is a dashboard job I still have to do myself.

The private portal, and the bug I found by logging in

The same Sunday commit added a small private portal: a single-user login with a PBKDF2 password and TOTP, KV-backed rate limiting, TOTP replay protection, and strict security headers. It hosts a download of my browser extension and an inbox for the site’s contact form. On paper it was done. Logging in for real the next morning said otherwise.

“Request blocked” on a correct login. The strict headers included Referrer-Policy: no-referrer. Under that policy, browsers send Origin: null on same-origin form POSTs, and my CSRF check rejected the null origin. The check worked as designed, and it blocked my own browser. a83061a Portal: fix “Request blocked” login now checks Sec-Fetch-Site first and relaxes the header to same-origin. A curl probe that doesn’t send Origin: null will never reproduce this. A real browser does, every login.

Sessions that rotate, and a boundary worth reading twice. The same commit replaced a single session cookie with a one-hour signed access cookie and an opaque refresh token. The token is stored hashed, rotated on every use, and expires after 90 idle days. The review question I cared about was theft, so presenting a retired token revokes its whole family. Parallel requests can race a rotation, though, so a just-retired token is still accepted for 60 seconds, as long as its successor exists. The code compares with strictly less than. That kind of boundary is where a reviewer should slow down: a comparison off by one in the permissive direction is a small hole that reads like a rounding choice.

Tools that can’t press send

Monday’s largest commit, d71de02 Add Claude MCP bridge for Timurista Studio extension , lets an assistant drive my Chrome extension through a local MCP server. It can open a page, extract an article, load my voice guidelines, and stage draft comments in the side panel. There are eight tools, and none of them submits anything, because posting stays a human action. paste_draft types into a comment box, and its test asserts nothing gets posted.

The socket listens only on 127.0.0.1 and accepts only chrome-extension origins, and both sides prove a shared token with an HMAC challenge. The extension’s Playwright suite lists 13 tests across two files. Seven run the bridge end to end, from MCP client to server to extension, and one of those checks that a wrong token is refused. One of the older tests calls a live model and skips when there’s no key. The last recorded run on disk passed.

The same afternoon added a ten-week LinkedIn queue of 20 evergreen posts, dated September 22 to November 25. It’s a file of drafts, and nothing in it publishes itself.

What I didn’t check

In keeping with the rest of the series, here’s what’s missing.

• No regression test for the form reveal. The fix is a checklist step, not a test, so the next edit depends on me running the read-back.
• No end-to-end suite for the public site. The extension has Playwright coverage, while the site has a shell script for its API. I reviewed the mobile layout by eye, and no build fails if a page scrolls sideways.
• No recorded performance run. The choices above should keep the hero cheap, but there are no Lighthouse results in the repo, so I’m not quoting any.
• Orphaned zone routes. They’re harmless while the old Worker is retired, but they’re still configuration nobody has reviewed.

A checklist for your own rebuild

1. Write the brief’s invariants down first. Positioning, what each color means, what’s public and what’s private.
2. Review the live page for what it claims, not just the draft for whether it works.
3. Source every number or delete it, including on old pages you forgot you had.
4. Treat a conditional reveal as access control. Test as the respondent you want to exclude, and read back the stored definition.
5. Ship drafts behind a schema flag that every listing, route and cross-link filters on.
6. Check what actually serves a path, not just what deployed. Old routes win without telling you.
7. Test security headers in a real browser. Curl doesn’t send Origin: null.
8. Put a human on every boundary that spends, posts or grants access, and read the comparison operator on every grace window.

The site took one evening to go live and two more days to become accurate. That ratio is the job. If your team ships quickly with AI assistance and you’re not sure yet that what shipped is accurate, that’s the work I do.

Previously in Human in the Loop: TigerMill: quality gates for an AI content pipeline. Or start from Part 1.