Gavelhouse

Gavelhouse shipped to production on Cloudflare Workers, built around a 51-entry HOA reserve-fund rule table covering all 50 states and DC, each row carrying its own statute citation.

The decision

Gavelhouse’s deploy pipeline refused to start unless the branch was master, the working tree was clean, and local HEAD matched origin. It existed because one person shipped to production with no reviewer and no separate staging environment. The same preflight check injected the verified commit SHA into the build as BUILD_COMMIT.

After wrangler deploy returned, the pipeline polled the live URL (/api/health for the API, the rendered build-commit meta tag for the two Vite/Astro front ends) until the commit being served matched what had just been pushed, on the reasoning that a zero exit code from wrangler is not evidence the edge is running the new code.

A guard scanned every tracked package.json for a raw wrangler deploy call outside three explicitly sanctioned scripts, and a public-facts guard scanned every tracked text file for retired brand strings, including the product’s former name, so a stale reference could not survive a rebrand into a shipped page. An SEO audit ran inside the same pnpm run verify gate, before the build. Together, the preflight checks and the guards let one person ship to production without a reviewer or a staging environment, with every deploy that ran through a committed script checked before it shipped.

Architecture

Three deployed applications and two shared packages, all on Cloudflare Workers, backed by Postgres through Hyperdrive.

The one rule the product argued for lived in a single function: postEntry.ts summed debits and credits separately for the operating and reserve sides of a journal entry and threw before either side could cross into the other. An audit-trail middleware wrote an auditEvents row for every mutating request across six route groups, derived generically from the request path, body, and response, so no route handler could forget to log itself.

Tenant isolation (a communityId predicate scoping every query to the caller’s HOA) was caught missing six separate times across review phases, and fixed before merge each time.

The KV-backed rate limiter carried a documented, bounded race: Cloudflare KV has no atomic increment, so two concurrent requests could both read the same counter and both pass the limit check. The worst case was quantified in a code comment, and a Durable Object fix was judged not worth the added infrastructure for what the limiter was protecting.