California IIPP sells state-aware OSHA safety documents to contractors through an AI safety-expert assistant. The founder's prototype had no payments, no tests and no session isolation. The later storefront was feature-rich but unlaunched: fulfillment could lose paid orders, there was no CI, the document engine ran only on the founder's home machine, and an audit found account-takeover and charge-without-fulfillment paths. Generated documents were also unverified, and the spec called for an LLM rewrite and review stage that didn't exist.
MVP (March-April 2026): consolidated the backend on FastAPI, added streamed Claude responses, guided document flows, English and Spanish, Stripe checkout and a free-question paywall, replaced the external RAG stack with the client's in-memory regulatory ontology, and deployed to DigitalOcean with a 194-test suite and load tests.
Storefront launch (June-July 2026): audited the app, then shipped durable queue-based fulfillment with idempotent Stripe webhooks, CI with secret and SAST scanning plus a money-path pipeline test, and production monitoring that regenerates the whole 101-document catalog on a schedule. I moved the Python PDF engine onto its own server with tests, a golden-fingerprint gate and a deploy script that only restarts on a pass.
LLM quality pipeline: a fail-closed verification gate, an LLM voice pass that may only rewrite editable prose and is rejected if a mechanical checker finds altered regulatory text, citations or numbers (falling back to the deterministic PDF), an LLM reviewer with shadow and live modes, multi-model routing through Vercel AI Gateway, and a daily drift eval for the intake extractor.
Next.js 15, React 19, TypeScript, FastAPI, Flask, Python, fpdf2, BM25 retrieval, Anthropic Claude, xAI Grok, Vercel AI Gateway, Stripe, PostgreSQL, Valkey, Vercel, DigitalOcean, Resend, PostHog, Playwright, Vitest, pytest, Gitleaks, Semgrep
v1.0 launched to production on June 24, 2026. The voice pass was live for 24 document types by July 2. The LLM reviewer caught a real OSHA 1904.39 reporting error in the flagship document, which was fixed in the engine. Paid-document field fidelity went from 33% to 73% across the catalog, and the incorrect "SAMPLE" watermark was removed from all 101 paid documents. The MVP load-tested at 50 concurrent users (~95 req/s) with zero failures on a single small container.