01
Audit and three-bucket triage.
A pen-test-level review of the codebase produced a prioritized plan: stop-the-bleeding fixes for the immediate exposures, short-term hardening for systemic gaps, and long-term architecture work. The plan got real engineering on the dangerous half of the audit while keeping Baden's team focused on the work they enjoy.
02
A new architectural foundation.
Centralized authentication and authorization, database-backed sessions, normalized permissions, repository-level access enforcement, impersonation handling, and audit logging. One controlled layer for protected data access instead of scattered checks across dozens of server actions.
03
A wrapper pattern instead of a rewrite.
The old patterns got wrapped, not torn out. That let the new architecture take hold while the existing system stayed live — and let the build process enforce the new patterns on every new feature, so the codebase couldn't quietly drift back.
04
A real release pipeline.
The app moved out of one developer's IDE into a proper test environment, with a staging-to-production rollout the team could own. GitHub collaboration, AI-assisted code review, and a release cadence that let them ship without praying.
05
An AI enablement layer on top.
Hands-on training for Baden's team on Claude and Cowork, vibe-code project planning to keep future builds from repeating the same patterns, and custom Claude skills mapped to Baden's actual workflows. The platform stopped being a one-time deliverable and started compounding.