Software built and kept working, with the evidence for every change.
We deliver software the way a factory does — planned, built, checked and reported, owned by a small accountable team — and we look after the infrastructure it runs on. Two different jobs for two different readers, so pick the one that is yours.
Your velocity went up. Something happened to your codebase that nobody can name.
You adopted AI tooling and more code started arriving. Reviews got longer. Bugs came back from files nobody changed. We build and maintain software with the checks that stop that, and take over systems somebody else built that nobody can now explain.
Founders, CTOs and engineering leads →Nobody here owns the infrastructure, and everybody knows it.
The server was set up by someone who left, backups run but nobody has restored one, and a former contractor may still have access. An asset review, set up properly once, then watched by a person.
Small firms without IT staff →We build and maintain your software, and hand you the evidence for every change.
A delivery service, not a tool
Run by AI, owned by people
You keep everything, including the reasoning
If one of these is yours, we have done it before.
You have something to build
You inherited something nobody understands
Nobody owns your infrastructure
An AI tool built it, and now it breaks
This is not our claim. It is what 2026 published.
more issues in pull requests containing AI-assisted code than in human-written code
arXiv preprint 2603.28592, March 2026maintenance costs by year two, for teams that do not actively manage the debt
Innovative Group, 2026Published figures, directional rather than audited. Three of the four come from the same 2026 analysis; the first is a separate preprint. Every one is linked so you can weigh it yourself.
Two ceilings nobody warns you about.
We wrote these in July 2026, from running a factory past 165,000 lines. The measurements since have pointed the same way.
Your reviewer is your throughput
It degrades exactly where you are going
More generation makes it worse, not better.
Buy more AI tooling
Hire senior engineers
Bring in an agency
Gates decide what ships. Not prompts, and not optimism.
Agents do the work; 6 checks decide whether it reaches your product. The last one asks whether a real person can finish the job on the running system — the failure tests cannot catch.
Understand
We read your problem — or your existing system — into a map of what it is, what depends on what, and where the gaps are. You get a plan you can challenge before anything is built.
Build
The work is split into small, tracked items with agreed acceptance criteria and assigned to the right specialist. Every change is isolated and reviewed.
Prove
Six checks run before anything reaches your product — ending with whether a real person can finish the job on the running system.
Report
Progress, quality and cost are recorded as the work happens. One live board, always current. Blocked work shows the day it blocks.
Our own product, not a pilot — and not a client engagement.
These come from the live cybersecurity platform we build on this factory — 165,000 lines. That is the friendliest case there is: we set the scope and we chose the stack. Position as at 2 August 2026, recomputed from the work record rather than typed into a slide. The same board reports that 43% of work was later redone and that queueing time rose as parallelism increased. All of it, including those →
What we have learned running it.
Wasmtime sandbox escapes: CVE-2026-115889 and CVE-2026-115893, and the fixed version that depends on your release line
Two critical Cranelift bugs let a crafted WebAssembly module escape the Wasmtime sandbox. One hits every architecture, one only aarch64, the fixed versions differ, and several early summaries got the mitigations wrong.
PHP2Shell: what to do this week about the two PHP flaws patched on 21 October
Two critical bugs in PHP itself affect almost every PHP release since 2012. Which versions fix them, how to check a server without being fooled by your package manager, and what to do if you cannot patch today.
Pillow CVE-2026-112393: who the TIFF heap overflow actually affects, and the two CVEs that came with it
A heap overflow in Python's most widely used imaging library, present since 2013. It hits one specific pattern, early summaries got that pattern wrong, and the same release fixes a JPEG thumbnail bug that probably matters more to you.
Start with one piece of work.
Give us one piece of work and read access to one system. We map it and come back with what we found, what we would build and what it would take — before any commitment. About a week from read access to write-up. One service or repository up to roughly 50,000 lines; a larger estate we scope first rather than promise a week for.
Talk to us